controlling storage class access per namespace (Service Providers, Namespace-aaS, etc...), Kyverno could be a good option.
you can find the Kyverno policy here: https://github.com/YvosOnTheHub/LabNetApp/tree/master/Kubernetes_v6/Scenarios/Scenario25
GitHub
Hands-on lab to try all Trident's features & architectures - YvosOnTheHub/LabNetApp