Filter commands from Group Commands

I understand the usefulness of group commands. However in some instances these can be dangerous. For example on a group of servers in a data centre you may want to allow engineers to reboot individual servers, but would not want them to be able to reboot the whole data centre at once.
If a policy allows for reboot, shutdown etc. on individual servers, can you add the ability to turn off these commands at the group level?
At the moment the workaround is to disable reboout in policy, and just use a reboot command line or script when needed.
Thanks!