In zabbix front-end, we can restrict user access only by groups. Because in host prototypes we can give some group prototypes it is impossible to restrict access to created VMs by resource pool. We created our own LLD rule in VMWare python API, which return also resource pool path.

{

  "{#VM.RPOOLPATH}": "/first_level/second_level_resource_path",
  "{#HV.NAME}": "10.6.200.63",
  "{#CLUSTER.NAME}": "some cluster",
  "{#VM.UUID}": "50197152-d369-4f53-5915-2dea85c5292c",
  "{#VM.NAME}": "VM.Test"
}

And in host prototype we can use {#VM.RPOOLPATH}