Hide notes and prevent host passes for consultants

We have an on-premis installation and manage support for a number of clients. Some of the specific application support is however outsourced to third party consultants.

Although a pass is a workable solution, we need to give passes multiple times per day. It will be better to allow the consultants to log on to Control and provide support when necessary.
The current permission options are almost perfect for the above requirement, but the following two will assist even more:
1. Do not show the notes. Some notes are confidential.
2. Prohibit the issue of a host pass. We do not want a third party consultant to provide remote access to anyone else.