enabling rpc only with certain commands
I would advise not giving anyone direct access to your bitcoind instance. You need either a queue/ or an API in between that can throttle requests/ and manage ACL's as you require.