restrict access for tos users

Q: for users logging through ToS templates, without entering their own username and passwords, how do we restrict their access rights?

A: There are two ways to do so: