remove options for user

[WR]

We have an account (Pmaintenance) we add for our helpdesk that has access to delete and add printers as well as edit the config file thru the gui.  I'd like to remove that ability but haven't found a way to do so.  The addition and deletion as well as any config changes will me managed by a different group.  Help appreciated.

I've added the user to Administrators group

     # Administrator user group...
      SystemGroup sys root Pmaintenance


And I've allowed access from any subnet and access to the gui:

     Allow access from any subnet:
     # Show shared printers on the local network.
     Browsing On
     BrowseOrder allow,deny
     # (Change '@LOCAL' to 'ALL' if using directed broadcasts from another
     subnet.)
     #BrowseAllow @LOCAL
     BrowseAllow all

     Allow all to access the gui:
     # Restrict access to the server...
     <Location />
     Order allow,deny
     Allow all
     </Location>

Thanks