Set a VDC role to limit user access

If you are able to manage user roles, you can limit user access to the virtual datacenter for users that are subject to VDC restriction, for example, to give users read-only access.

Privilege: Manage roles, No VDC restriction

For more details see GUI Create virtual datacenter Roles