Permission is assigned on a service basis, not an endpoint basis. Therefore anyone who has access to invoke the
service will see all Task Manager endpoints associated with that service. Out of the box what you want to do cannot be done. However I would think that if you were to put your Workspace start points in their own process, with their own service access rights, and then have them all call your main process, as a sub-process, you may be able to get around your problem.