FB60, How to exclude a G/L account from being selected ?

Question

This is a continuation of a previous thread that was closed by accident!!
The original question hasnu2019t been answered yet.
Question
=======
I am in need to EXCLUDE a specific G/L account from being selected, from the drop down list, when executing FB60 (Enter Vendor Invoice) to create a new vendor invoice ?
1) Is this doable ?
2) Could this be done programmatically (ABAP team) ?
3) Could this be done at Security Role level (Basis & Security ABAP team)  by using the field BRGRU of the F_BKPF_BES Authorization Object ?
I have received so far very useful remarks from Paul01, Mauri, SAPFICO, Mohammed Zia, and Sudhaker Gogula.
THANK YOU ALL!
Here are my answers to each one:
To Mauri:
========
YES, we define the authorization Group via FS00 --> Control data, which means the relevant authorization object will be F_BKPF_BES.
As I said earlier, the corresponding field will be BRGRU and and not BEGRU.
Then the question is, WHICIH AUTHORIZATION GROUP DO I SET, for the value of BRGRU, there are thousands !!
To Mohammed
============
How do I "block that GL account for postings in GL master record" ??
Programmatically (ABAP) or via Security Role(s) ?
To Sudhaker
=========
Could you please elaborate the solution USE VALIDATION.
I am not familiar with that!
Is it something that ABAPers do ?
Could something be done by using Authorization Groups // Authorization Objects ?
Thank you all, in advance for your comments/ideas/solutions!
Best regards,
Tom

Answer 1

Dear Tom,
if You insert an authorization Group into FS00 then You should create a role by transaction PFCG to link to Your user.
Then You have to link to this role the transactions You want the user to use and into the Authorization TAB, You have to insert the relevant intervals of Authorization group, excluding the one to which the user cannot post to:
Changed    Accounting Document: Account Authorization for G/L Accounts
Maintained Accounting Document: Account Authorization for G/L Accounts
   Activity                       Create or generate
   Authorization Group            HERE!!!!!!
Then You have to save and to generate.
Anyway the easier way, in my opinion, is to build up a validation by OB28 at line item (call up point 2) and define an error
message in case the use should use the G/L Account in question.
example:
Prerequisite
BKPF-BUKRS = 'MAO1' AND SYST-TCODE = 'FB60'
Check
BSEG-HKONT = '160000'
Message
Message type   E         Message class     Z1
Message number  032
Message text    Please don't use the G/L account 160000
I hope this can help You.
Mauri