This is for me from a far past, but as far as I know, anyone in the environment can access Mobile Search, but only those with an archive will actually be able to do some searching. As MS is a website if I recall correct, you can probably do some tweaking on that part, either on a firewall, or on the published website.
It might be worth a call to support, they probably can assist.
I have not found any specific document/kb-article for this.
You can configure provisioning groups just for IMAP (mobile) Access.
Only those users who are provisioned will have access to an archive.
The provisioned user will get a message with all the details that need to be configured to get access to the archive.