You cannot restrict a user from a particular service running on a VSE, but can restrict the user from access a VSE.
Create a Resource group from IAM console.
Access this resource group from Devtest portal using super user account and add/remove resources (in this case, VSE) based on privileges you want to assign to the user and then, from IAM console, assign this resource group to the user.