You can create blacklists for paths you do not want your users to be able to self-provision from mobile devices. These lists must be assigned to a User or Group policy and are valid only for self-provisioned paths. When the list has been created and assigned to the proper Users and/or Groups, you need to enable the Block access to specific network paths for every User/Group policy that you want it to affect.