Limit available beans in Groovy scripts

In a Spring Boot application embedding Camunda, I want to limit the beans that are exposed via Groovy scripts to the user such that the user can not call application internals but only the beans that he is supposed to be using.

As an example, a component like the following is accessible with mySecretBean.f(). but should not.

public class MySecretBean {
    public void f() {}

Standard Spring seems to offer something like this: Spring Beans in Processes |

I could not find something similar for Spring Boot and was not yet successful in creating something like postInit hooks for the SpringProcessEngineConfiguration.