What security mechanism can an administrator use on an OSSV client to use permissions allowing...

https://communities.netapp.com/servlet/JiveServlet/previewBody/4791-102-2-13466/tr-3466.pdf

In order to restrict the NetApp secondary systems that are allowed to initiate backups from an OSSV host, the QSM Access List field can be populated with the hostname of the secondary using the OSSV Configurator utility. When using this option, make sure the “Check QSM Access List” box is enabled.

The snapvault.access option on the NetApp secondary can be used to restrict the OSSV hosts that are allowed to initiate restores from that secondary system. This option can be populated with a list of hostnames for each OSSV host. For example:

options snapvault.access host=ossv1,ossv2,ossv3

Screenshot of the svconfigurator GUI; note the QSM access list checkbox and field.