Well, technically, yes you can. You can block port 80 and 443 to each Unity server, and then the admins would only be able to log into their local servers. I don't think you can change any settings for other servers in the SA Web page anyway. The users? Well, that could get tricky.
How is your organization set up? Is it all the Unity servers reading from one address book, or will each location have it's own address book? If each location has it's own address book for whatever mail store you're using, then admins will only be able to add/remove users that are in the local address book.
If they're all reading from the same address book, depending on how you set it up, I remember reading something about Unity will not touch the settings another Unity server put into an address book. It'll only modify it's own. You'd have to check out the Unity documentation a little more to find out the exact conditions of that happening, though. I can't remember if I read it in a book or on the online docs. And after consulting my co-worker, he seems to remember the same thing; a Unity server will only modify something that it has created, and will ignore anything created by other Unity servers.
Now, if you have this all set up as failover, that's a different story.
