This document describe how you can allow minimal access to CCA UI to a whole Group in Active Directory \ LDAP
Note, this is Unsupported, but the community can assist as applicable