Deny add entry in root meant for Private Vault ?

We are currently testing with an MS SQL Server datasource and RDM version 9.0.12.0 and are preparing for a PoC which we intent to run next week.
When the permission "Deny add entry in root folder" is set on a user, it seems not possible anymore for that user to create a new credentials entry in their Private Vault. It doesn't make much sense to ever deny a user to modify their own Private Vault.
Is there a way to deny normal users to add an entry in the shared root folder while still allowing them to add an entry in their Private Vault?