I appreciate all the replies. Would someone be able to provide some examples of how user custom fields are normally used?
It seems like I could just add a custom field related to the given subforum (say, ‘subforum123’) to each permitted user, and then when a user goes to a subforum page hit the api to see if the user has the required custom field. If yes, then they can post there. If no, then they cannot, and perhaps I just hide the “new topic” and “reply” buttons.