Prevent MDG users from accessing t-code XD02

Hi

We are implementing MDG 6.1 for Customers in co-deployment mode, meaning users that can create a CR can also access XD02 t-code;

Those users have XD02 in authorization object TCD.

How can we prevent them from using t-code XD02? We do not want them to bypass approval workflows.

Thanks