Basically, for each client, you can block or authorize specific users - either you pick block all except user A, user B, or admit all except user A, user B​. Then there's also a setting about whether you hide the name if blocked or not. Seems to cover all the bases. Sure, some service providers could get into trouble with this feature, but they also don't have to use it if they want to avoid trouble.

https://www.acreconsulting.ca/blog/108172-using-conflicts-to-track-prohibited-file

See attached screenshot from WISH (DV shelter software)