There are two way to limit notification.
For unauthorized users(groups):
(1) disable to register notification
(2) disable to trigger event
In fact, (1) is almost non-sense.
When users(groups) are changed their permissions, it is not easy to maintain notification table.
Thus, (2) is the only way to limit notification.
If you write a module with view permissioning in module, you should specify user_list into triggerEvent().