Yes, templates can be restricted. You manage access with the category security settings.
I, for example, have a Templates category for common templates (My staff group and my TL4 users can create templates, but everyone except TL0 is able to use them).
There is also a section about private templates in the topic about the plugin.
You need to enable the Discourse templates enable private templates setting. I think it’s not necessary for moderators, but I would configure Discourse templates groups allowed private templates accordingly. Then you select the tag that should mark PMs as a template. There is also a setting which configures who is allowed to tag personal messages: PM tags allowed for groups. If that is all set up, the moderator can send a PM to themselves, add the tag, and they have that as their private template.