How to deny access if url is changed manually?
I've managed to solve this.

In my hook_form I have:

$querystring = drupal_get_query_parameters();


So for this case I just need to check if the user in the url is in the array of users allowed. If not, I can deny the access to the page (I still don't know how to deny the access though)