Rather than attempt restriction at the source, do the restriction at the server.

Deny the user at AAA access rights at the server.

If you manage to lock down the user at AAA, what happens if he changes seat and is sitting at CCC?

If the user has a C compiler at AAA he can do anything he wants, so you have to restrict at the server.