How can we restrict USERS in vCAC to access self-service portal?

We have a huge deployment through vCAC 5.2 and as the environment is huge it is hard to track the deployments to be genuine (by Managers) or random (By Users).

I want to assign a group of people to the USERS role in vCAC Provisioning Groups and by default they get access to the /vcacselfservice (Self Service Portal).

Is there any way I can restrict users to have access to the self-service by still keeping the user privileges to access machine instances which will be provisioned by their managers.

Can I change the authentication rule from “allow users” to “deny” or something similar in the aspx files or config files of the vCAC website or self-service portal?

Thanks.