Restricting mail sending from SQL Server 2008
You just need to ensure the profile isn't public when you assign permissions and access to it.  The stored procedure in the msdb database is msdb.dbo.sysmail_add_principalprofile_sp, and this stored proc is what grants permissions for an msdb database role or user.

Excerpt taken from BOL on the subject:


  To make a profile public, specify a @principal_id of 0 or a @principal_name of public. A public profile is available to all users in the msdb database, though users must also be a member of DatabaseMailUserRole to execute sp_send_dbmail.


BOL reference on Creating a Database Mail Private Profile.