It appears that anyone with a teaching role may add a new External tool instance in a course as long as they know the provider URL and any authentication details. However, I'd like to limit the addition of External tools to only those configured globally by the admin. I've played with the permissions, logged in as other users, but if the option to add a new instance is there, it can be configured to connect to any working LTI connector.
I've tried setting Add course-specific tool configurations to not set. But this doesn't seem to prevent a manually configured LTI connector. I also tried setting Add new external tool activities to not set, but this just prevents adding any LTI tool.
Am I missing something, or is this the only behaviour?