A couple of questions

May need more info to answer your request... 
   Are you asking about an operator GUI from the Media Server or from the client. Are you asking if you can create a user account for the Admin Console and can that be restricted in it's functionality?
The quick answer is yes. But it depends on where they would connect from and how you set the account up.
   I have simple accounts on my Unix Media Server and anyone with a proper established account on that server can log into a Backup, Archive and Restore session, which is what I believe you are asking.  Only accounts with root or SuperUser access have full admin rifghts to the Media Server. That is also how I have accounts set up for Windows Server Clients. They do not have SU access to the Unix Media Server and therefore have rights that would be similar to a backup operator. 
 

If it has data you don't want to lose - write protect it.

If you don't want to write to the tape but not have a scheduled job write to it, (if it is not assigned) move it to another pool.

you can always put the tape in the library and NOT inventory - then use robtest to move the tape to a drive - so long as robtest is running nothing else will.  But this has a whole bunch of issues with it - nothing else will run, if robtest is not running NB could try to use the drive or if the tape is still in the slot try to put another tape in the same slot.

I have never had a situation where this would happen to me.

If you want to put tapes in the library that you do not want NetBackup to use for backups, you can simply put them in the NONE pool.

You can then use tpreq (see the commands guide) from the command line to mount the tape to use for other things. Yes, you can mount tapes from the NONE pool using tpreq.

Once you're done with the media, use tpunmount to have the media unmounted and returned to it's slot.

This option is better than using robtest as it will allow you to perform the mount and unmount without holding robot control. (NetBackup cannot perform robot operations as you have exclusive control of the robotics while in the robtest session.)

It is impossible for NetBackup to use a tape that is not in any of its pools.
The tape was either in the required pool or in Scratch.
There are number of formats that NetBackup will not overwrite, unless you manually selected to override this protection. These formats are list under Host Properties -> Media Server -> Media -> Allow media overwrite.
Please DO NOT blame the product for oversite on the adminstrator's site. I have worked with this product for close to 11 years, supporting 100's of installations at customer sites.
Like Judy said: I have never had a situation where this would happen to me.

You can configure barcode rule for label series you want to use, but also rules for barocode you don't want the system to use, they just need to go into the "NONE" pool. The downside of this practice is the need to maintain it every time you introduce a new label series

A example:

We assume A00000-A99999 is you normal media serie, but you also have B00000-B99999 for another Netbackup doamin.

You would then configure barcode rules that do this:

A00000-A99999 -> Scratch
B00000-B99999 -> NONE

The rule must of cause be reversed on the Netbackup domain that uses B00000 serie. It's not possible to use wildcard.

Guys thanks for your input. I think I better further explain  my setup here.

I have 1 Netbackup server which is also the media server, running on RH 5.4.
I have 4 stand alone drives (IBM 3592) not in any silo/robot. All connected to a fibre switch and zoned off in a seperate zone to all other drives here.
I have a very small pool of tapes,  2 for the catalogue back ups and 3 in the scratch pool at the time of testing. (currently just testing setup)

I was trying to simulate the situation where someone accidently places a tape drive thats not in the any of the NetBackup Pools.
Unfortunately netback up took this tape and wrote to it and add the tape to the netbackup pool.

My pools range from AA0000-AA0004.
The tape it wrongly used was 123456. It had a header and data on it too.

It would be a bit impractical to asign every tape combination to the none pool, as we have hundreds of thousands of tapes here with varying label ranges.
Is there anywhere I need to define what ranges Netback can only use? (apart from just addind new volumes)

As for question 1.  I Just want limited access for the operators to see what tapes to mount and allow may be confirm the mounts if need be.
I would assume this would be stated from the Master.

Q1:

You can't define a "allowed" series of media - Netbackup is missing that feature. You can only limit the damage if it happens. E.g  you can make the NONE pool the default pool, and then use barcode rules to move media with the right barcode into a desired pool. You may have to play around with "advanced robot inventory options" to see if you can find a golden middle way

Q2:

On the master server add the user with normal privileges (non root)

• edit the file /usr/openv/java/auth.conf
• add the line {USERID} ADMIN=AM+DM where USERID is the userid of the user added in previous step. AM="Activity monitor" DM="device manager".
• save file

You're operator can now use his UNIX credentials to log on the local java GUI or the Windows remote Java GUI. Additional info regarding non-root access permission is documented in the admin guide.

Thanks for your help guys and in particular Nicolai

Thanks again to Marianne & Nicoli.

I disabled the stand alone drive extent ion and this seems to have solved my problem.
I even opened a ticket for this with Symantec about this issue and they told me Veritas will pretty much use any tape it doesn't know about i.e not in it's catalog and had no solution or work around for this.
Very worrying!

Thanks,
Shaigan.