I have nagios contacts set up, and these successfully limit access to view hosts and services in the nagios web UI.
But pnp4nagios gives access to all graphs (by editing the hostname and service name in the URL) - it does not respect the nagios-defined access controls.