How to set up fine-grained admin permissions or limit export capability?

I haven’t tried it myself but declaring the settings in the env has precedence over settings in the UI, and it would probably also hide the settings from the UI as well. You can try it out.