Restrict permission to custom modules
When you define the page the form is on via hook_menu(), you need to set the access rights via the "access callback" and "access arguments" settings.

The simplest way to do this is to provide an array containing a single permission value as the "access arguments" setting.