He can do restriction with "Allowed VLAN´s" on the Uplink trunk ports. This filters all MAC-addresses from other VLANS.
We do this anyway. But the customer want's to prevent users from using the uplink cable of the mini switch to plug in a not whitelisted device.
The switch is not locked in a rack or similar.