When adding custom SELinux policies, all that users can do is to add more allow rules. SELinux does not have a deny rule that can be used to remove currently allowed access rules from the active policy.
If the current policy is too permissive to the administrator's liking, then the administrator will need to update the policy rather than just enhance it. And that implies that the administrator has access to the current SELinux policy rules used.
Replacing existing policies depends on the SELinux user space utilities (the more recent one supports priority-based loading) and the source of the current policy. Let's look at two approaches: one for RHEL and another for Gentoo Linux.