You can deny access to specific main tabs to groups of users. To do it, deny access to the script that creates the specific main tab. For the procedure, see Restrictions on scripts.

On the following screenshot, the access to the Publishing main tab is denied to the group Reporters.

Here are names of scripts that create main tabs in Ted4 and Fred4: