Is there any reason/need for these non-admin type users to even be in the ACS database? If not simply remove them and they won't be able to get into the routers anymore.
If they're there because ACS is checking an external user database that they are all defined in, then you can easily set up Database Group Mappings and put the admin users into a specific ACS group (say Admins). Go under External User Database - Group Mappings and define a group mapping such that the users in say, the "admin" group (or some group you define) in your external user DB get mapped into the "Admins" group in ACS. Then give this Admins group access to the routers as normal with their authorization. All other external DB users can get mapped to the special "No Access" group in ACS (available in the drop-down list), which basically denies them access to everything.
If you have entered all users into the ACS internal database, but only a portion of them need access to the routers, then first thing you will need to do is create two ACS groups and separate the users accordingly. Then the easiest way to restrict users in the non-admin group is to create a dummy NAS entry for a non-existent NAS, modify the non-admin group, check the "Define IP-based access restrictions" box under the NAR section and then add that dummy NAS in as the only "Permitted calling point" (add * in for Port and Address also). This then only allows them access to the dummy NAS, which of course will never happen.
You could of course do it the inverse way and add all your NAS's into this list as "Denied Calling Points", up to you.
Leave the admin group with no restrictions and they'll be able to get into all NAS's as they can now.
