OIM Administration

How do we prevent OIM users from viewing other persons details? In our instance once the general User logs in through OIM self service page they are able to go to Administration-> Users -> Search Users (similar to User with Sysadmin role). Our requirement is have User1 to be designated as System Administrator who will manage other users and provision entitlements instead of logging into as xelsysadmin. We have ALL_USERS role assigned by default to all OIM users. 

We also want to know if we can restrict access to host:port/sysadmin URL and only allow host:port/identity URL. Please advice.