Can create privileges restrict by subclass?

I'd like to have certain (Document) subclasses availalbe for create by import, but not available for users to create.  Can I impose such a restriction?   If I disable the subclass, I don't beleive I'll be able to create docs of this subclass (via PX or import).

On the other hand (and somewhat understandably) it seems that create privileges do not let me select criteria on the subclass that have any restrictions in them (such criteria do not show up). Agile seems to let me create and use subclass-level criteria, but that will require a new criteria (and a new privilege) for each 'allowable' subclass. Is this the only way?