I suppose I could tie it to the ACCESS_ADMIN permission, then people can access it but not touch other things, correct?
In fact, I will tie it to the ACCESS_ADMIN permission - that way I can ensure they can access the admin pages as normal, but you can also prevent them tampering with other options.