Just create a custome role and remove the power on permission, e.g clone an administrator role and create new custome role then edit the role and uncheck the option of "power on" under the virtual machine>interaction>power on.
Assing this new role to the users whom you don't want power on permission.
Thanks for your replay but only for few vm's i need to apply this policy like nobody should power on except admins.
But in above scenario if i create role like that so they cannot even power on there normal vm's. i need to apply this policy only for few critical servers. so any option is there.
Insteed giving permission based on Cluster/Datacenter, give permission based on folder. The same i have tested in my enviornment and it's working.
Seperate your VMs in different folders and assign different permision to different folder for the same user.