Deployment Solution

From what I've seen, this is looking like a "no", but is it possible to secure the Deployment Server console so that a group can only see a certain AD OU of computers to deploy the agent to?

Assuming no, I was thinking the next best thing would be to have them use an account for the agent install that only has permissions to their computers. Then have them specify their secured group in the console to place the computers into when the agent is deployed.

I know you can secure the DS console, however, I don't believe you can secure the Remote Install of the AClient/DAgent. If the users in question have admin rights on the destination computer, they will be able to install, if they don't, they won't be able to install.