EMSS implementation

We are implementing EMSS but need to see about limiting access to various screens in EMSS. Right now we have '-1' accounts for those that need daily entry/update functions. We also have regular accounts that we would like to use for EMSS functions. We are also planning to use kiosks for users that do not have a computer and placing several offsite from the main office. The problem we are having I believe is that our security tech is binding the regular account to a '-1' account and the regular account has the same 'rights' as the '-1'. We want the EMSS to only have inquiry access during the start up phase. Can we limit the regular accounts to just inquiry. We are on LSF9 and using LAUA until we get 9.0 security running.