In AEM, CRXDE access can be disabled by
1. Disabling the required bundles
Adobe CRXDE Support (com.adobe.granite.crxde-support)
Adobe Granite CRX Explorer (com.adobe.granite.crx-explorer)
Adobe Granite CRXDE Lite (com.adobe.granite.crxde-lite)
2. From dispatcher https://helpx.adobe.com/experience-manager/kb/LimitAccessCRXandCRXDE.html
What if CRXDX needs to be disabled/restricted for a few users/groups.
One of the solutions could be to check the user when the user attempts to access CRXDE and block the access or re-route.
Step to Implement the above approach :
1. Create a Sling Filter to check the CRXDE access request.
2. Create an OSGi configuration and service to maintain restriction data(Users, groups, excluded user)
3. Create a clientlibs to re-route the user to another page while accessing CRXDE.
In the Sling Filter get the current user and check against service configuration and if found then replace/redirect one of the existing js to our custom clientlibs js.
Custom clientlibs will then take care of blocking CRXDE.