I am not sure if this will help, but what I do is I create a security group in OE and don't create that group in any other module, once a staff is linked to that group and try to open another module the system will alert them that that user group is not associated with that module and they won't be able to get in.