Let user exec console, but not create new containers

We need users to be able to open a console into containers which were assigned to those users, but not create their own containers - i.e. kind of demo environment where we can set up our containers and let users play with them.
We tried purchasing a license for role-based access control plugin, but it disables console access for the read-only users.
Are there settings to achieve the kind of access control we want? Or is there any programming interface that would allow us to develop our own plugin for that?