You'll want to read through the "Policy Administration" section here, if you're not familiar with it already: https://support.ptc.com/help/wnc/r12.1.1.0/en/index.html#page/Windchill_Help_Center/policyadmin/PolicyAdminAbout.html#
You'll also want to review what Role(s) each of the users is in. It may be that you can move them to another role that gives them the access they need, without giving the Change Request creation. You could also configure such a role, then move them to it. You could also add an ACL to deny the permission. It all depends on how your system is configured, and how you want to maintain it.
My personal preference is to only grant users access they need, so that deny ACLs are unnecessary. (But others will have valid cases for when it's necessary).
