I'm not to sure if I understand the problem right. But if you are trying to block access for a user to One CSS configuratoin, then it is not possible. MLA can be used to get different level of access to CallManager, but MLA also would not remove access for one single CSS/Phone. It would be for all type of settings. Please check the doc on MLA for more info about it.
