I wanna share the solution that I choose:
I choose to use the self-enroll limited to 'Only cohort members', described by Catherine (many thanks for that! I wasn't aware of that setting).
I manage that creating 2 cohorts:
- a regular cohort for regular users (company members that must be allow to self enroll every where)
- an exceptional cohort for exceptional users (users that must not be allow to self enroll on critical courses)
The self enroll for critical courses is then restricted to the 'regular cohort'
I create a MOODLE plugin called 'regularcohort' to handle that.
The plugin allows to add all newly created users to the regular cohort. There is also a synchronization script that will allow to populate the cohorts at the first time.
Users that are members of the exceptional cohort will be removed by a synchronization script.
Now, this is ok. I can prevent exceptional users to self-enroll to critical courses.