Segregating catalog items

Issue

• What is the recommended way to segregate access to catalog items? Can a user in a certain role only have visibility to one catalog item, while other users can see all of them. Taging the "restricted" user so that they can only see items with a certain tag (i.e. Provisioning Scope = All), does not work because, VMs cloned from the template are not tagged, thus the user cannot see the vm after it is provisioned.