How to restrict AP AR subledgers from entering an excluded company

Hello, we are trying to prevent our AP and AR group from entering invoice distributions to a specific company 'XX' that is in a separate ledger, LE and OU.  This company XX is assigned to the Ledger Balancing Segment Value so that our PO Group can procure from one OU and drop ship to Company XX OU.   The security rule is working as intended before we assign XX to the ledger balancing segment value but has stop working after the assignment.

How can we allow the PO group to do drop ship to XX and prevent AR/AP group from entering XX by mistake in Distributions.