To separate what ECL items the CMS users can see or select, consider these options depending on your use case.
Hide certain DAM items from all CMS users
If your use case is that the DAM has items that CMS users should not see or use, then don't expose those items through the ECL provider. That may be done programmatically in the ECL provider code or through however the DAM handles access for the configured ECL (system) user.
Control permissions on the linking items
Ultimately, CMS users will select ECL items from a linking Component or Page. Here you could restrict access on the linking items using:
- Permissions on the folders of the linking Components
- Permissions on the Structure groups of the linking Pages
- Optionally, permissions on the folder containing Schemas you want to restrict
By removing read on the folder containing select Schemas, users won't be able to create or edit Components based on those Schemas.
Separate DAM into separate ECL providers
Finally, if you have a use case that different sets of DAM items should be used by different Schemas, perhaps separate ECL providers to the same DAM might help. For example, you might separate images from videos and handle these through different ECL providers. See @Bart's answer to another ECL question for some context.