If users have access to the CCMUser web interface and if you have "Show Cisco IP Phone Services Settings" enabled (it is enabled by default) in Enterprise Parameters then users can subscribe to any service that you have configured on the CallManager.
In this case, one way to block access to services is to add a password parameter to the restricted services. Users who are allowed access to this service would enter the password when subscribing to the service, and those who are not allowed access would not have the password and would therefore not be able to enter the valid password when subscribing to the service. What would happen here is that when the user called the service from their phone (at run-time), the service (web page) would check the password parameter to make sure this was an authorized request, and if not, would return an "unauthorized" message to the user. A bit of a hack, but it would do the trick.
A second, more complicated solution would involve the restrictied service(s) doing a lookup of the device name using the IP address through the devicelistx report, and you would configure the devices (listing the device names SEP...) that have access to the service in advance. This way you wouldn't have to implement the password scheme (telling authorized users the password, and risking the passwords being shared with unauthorized users) and could have more central control over who executes the services. This wouldn't be as effective in an extension-mobility environment, though (there are ways around that too, but it just complicates things a bit more!). As in the above solution, this allows anyone to subscribe to the service and security is enforced at run-time to block out unauthorized use of the services.
If users do not have access to the CCMUser web interface or if you turn off their access to subscribe to their own services (which means an administrator would be responsible for subscribing users to services; that administrator would be your "security" to ensure that only authorized users received access to certain services), then you wouldn't have to modify the services themselves with the password parameter.
Sorry if that sounds confusing. The short answer is no, you can't control which services a user can subscribe to; either users can subscribe to services themselves or they can't and the administrator does it for them through the admin interface.
