Use LWC and expand the block-list it supports so that people can /cprivate machines. This may sound like a hassle, but with lwc you can use persistence of commands to speed protection up.
/lwc mode perisist on
That'll turn on persistence, then pick a command
/cprivate
Ok now everything you click on will be protected if it is a block that you have configured for lwc to accept.
You can use that to protect machines and still have them function.