You might be able to use the min_trust_to_send_messages setting (make the members TL3 and set the setting to 3).
If that won’t work for you, you’ll need a plugin that overrides Guardian.can_send_private_message?. That should be doable in a few hours of work.