You can put the extents for the volumes you want a person to use in a pool and indicate the user (which I assume is defined as a MANAGER) can only use that pool of DASD.
See DASD CONFIG (SUBPOOL and EXTENT records) and MANAGERS file (MANAGER record) documentation for further information.
For the common disks reallocation (6xx series of disks) things for VM:Secure are allocated according to VM:Secure's MANAGER's allocation set up/limits.
In most cases, that is VMANAGER.
See below for my console when I updated the PRODUCT CONFIG which caused VM:Secure to create a new common disk:
VMXCMN0672I The Servant Facility is active. Attempting to create a new COMMON disk.
VMXADD0649I The owning manager of VMSECURE is VMANAGER and its allocation limits will be referenced.
VMXMAN0579I Formatting new 0600 minidisk. Size is 3 , device is 3390.
VMXADD0552I Minidisk VMSECURE 0600 was defined and was formatted.
VMXADD0657I Allocation - subpool: POOL1, volume: SPACE1, device: 3390, location: 1804, size: 3 cylinders