Even if your cluster restricts users from directly accessing remote hosts, they can still use lsrun, lsgrun, and ch to run tasks on specific remote hosts.
To prevent users from accessing specific remote hosts and let LSF control which remote hosts are being used, restrict access to the lsrun, lsgrun, and ch commands.