Throw them in a group which doesn’t have the ‘create’ permission in the categories they can access.
Put everyone else in a group which does.
It’s some permissions work on each category, but assuming you have another user you need to do this with in the future it will only need the group membership to be applied.
You would need to automatically place all new users in the second group too, which could be a lot of work if you’ve no IDM or SSO managing your users.