I hope that you are using the MSS Substitution functionality from HR Renewal 1.0.
One way to restrict the manager user from creating substitution rules to certain set of users is by implementing the BADI WF_SUBSTITUTE. For the MAINTAIN_SUBSTITUTE method you can provide implementation, such that you do the check on substitute user here and return an error message.
Hope it helps.
Regards
Sagar