Can a user be restricted to only key payments from a payee?

No, but an icon is present indicating that the payment has been keyed from a payee and if that payee is being used for the first time or has been changed since it was last used. It is also possible to restrict a user to only approve payments keyed from a payee..