There are a couple of ways, depending upon what you still want to run on the system. You can set the logon ‘threshold’ to maximum, which will prevent anyone without OP/SM from getting on (with the HIPRI directive):

The other technique is to constrain the number of non-OP/SM users allowed to logon to the system. You do this with the ‘LIMIT’ command. This controls the number of concurrent batch jobs and interactive sessions allowed on the system. By setting these limits to 0, no additional jobs or sessions are permitted to log on. Those that are already signed onto the system are unaffected. But when they logoff, they will not be permitted to logon again until the limit is raised:

The first parameter is for the number of concurrent batch jobs, and the second parameter is for the number of concurrent sessions. For more information, check the MPE ‘HELP’ information on the JOBFENCE and LIMIT commands.