Hi,
You can perform vmotion from ESXi host which is not having shared storage by using xvMotion. This feature is available from vCenter 5.5 on-words. Just make sure you have our source and destination host are reachable and should be in cluster for communication.
Next, You can set the permission desired based on the role who would e accessing the vCenter or cluster via vCenter rules, like read only, or setting customer rule and assigning appropriate permissions.
Regards,
Sachin