Restrict access to version for ofs

Is it possible (without a routine) to deny access to a version to users yet allow the use of ofs for that routine?

That means the users will have rights in USER.SMS.GROUP to access the version.

I want to lock amounts on accounts from a local routine using OFS but I don't want to allow the users to use AC.LOCKED.EVENTS.

The problem is that the ofs generated from the local application will get SECURITY.VIOLATION if the users don't have rights in SMS, so I have to give rights in SMS. But I also don't want them to use the version for anything other then the execution of those OFSes.

So a user will be able to execute the LOCAL.APPLICATION (and generate an OFS for AC.LOCKED.ACCOUNTS,OFS) but the user must not be able to access it from the COMMAND.LINE.

I use OFS.GLOBUS.MANAGER. I have R05 and can use this inside the APPLICATION code. I find it easier to use and is faster then OFS.POST.MESSAGE. I could use a generic user and this is a solution we're considering, but it would be harder on us when we'll have to do the reports with the activity of each user (not impossible, but harder). I was considering to put a user in OFS.SOURCE (I don't put the user and password in the OFS so the system will automaticaly take the logged in user).

Yes, we could also do the take away the command-line (and user abbreviations) but I can already hear the endless moaning from operations department that I'm makeing their live hard on purpouse.