Yes you can.
In order to do so, you have to set the changes you want to have.
Then encrypt the virtual machine. (Menu -> Virtual Machine -> Settings -> Encryption & Restrictions -> set an encryption password and wait for it to complete )
This password you share with your user so they can use the VM.
After the virtual machine is encrypted you can then add additional restrictions.
For this you set another password on enabling the restrictions feature. This is the password you keep private.
In order to make changes to the virtual machine you need to have the restrictions password.
Hope this helps,
Wil| Author of Vimalin. The virtual machine Backup app for VMware Desktop Products
| Vimalin : Automated backups for VMware Fusion and VMware Workstation Professional
| More info at https://www.vimalin.com
| Twitter @wilva
| VMware Wiki at http://www.vi-toolkit.com
Thanks Wila, I make testing and found the Isolate icon was disable after enable Restrictions, then end user cannot share the data by drop.
Let me test more testing, thank your quick help and response!