Hi Felix ,
If they are changing / creating through webservice means either they are following by RFC or IDOC , So kindly check how they are processing and then if they are following same means , we can restrict process with user authorization level also.
Regards,
Krishna