not sure about permisions for client/domains however i have changed a select few applications (mainly e-commerse) to requiring a licence etc,
a simple solution for disabling/enabling the app vault is to create a seperate template for this user/client template inwhich the application value icon is hidden. unless they know alot about plesk they should not be able to gain access to the application vault