Hmm you may not be able to restrict home interface lookup using acl but you can restrict who gets to call the create() methods in the interface using declarative security.

The other way to restrict jndi lookups is to have a username/password for the jndi access.