Access restrcitions

hi. how can i “blind” the user from the actual resources?

meaning, when the end user creates a new vm, how can i do an automatic deployment and not letting him see the vcenter\datacenter\hosts? also, how can i hide irrelevant networks from the user?