RSS receiving and PO inquiry

We recently disabled the receiving bookmark in RSS because it was discovered that RSS users were "receiving" when they should not be. We later found out that some RSS users were using that page to look up PO information. And we do have users that should have access to receive.

I'm new to RSS. I am told that PO30 is the form that is used for receiving, but I don't see that our RSS security class has access to that token.

We need to put this bookmark back online. And we need to control access to being able to perform the receive function.

I see two ways to handle it:
1. Clone the receiving.htm and remove the button and have 2 bookmarks managed by bookmark groups.
2. Determine if its possible to use LS to stop the wrong users from actually receiving when they shouldn't and allow the ones that should access.

Any opinions, ideas, etc would be greatly appreciated.

TIA,
Karen