Ubuntu Security :: Disallow Both Ssh And Scp To 'other Local Users'

I am stuck in a weird situation and could definitely use some help from gurus in security area.

I have categorized my users into 3:
1. root user
2. other local users
3. LDAP users

I want to setup following 2 usecases:

a)
1. Allow keybased ssh and scp to root users
2. Allow ssh but disallow scp service to other local users
3. Disallow ssh and scp to LDAP users

b)

1. Allow keybased ssh and scp to root users
2. Disallow both ssh and scp to other local users
3. Disallow ssh but allow scp to LDAP users

For the 1. in both cases, I think PermitRootLogin in sshd_config could . For the 3. I am thinking of deploying rssh to control scp service access, since ssh will be restricted anyways.

Problem area is 2. primarily.

i) How to allow ssh but disallow scp to 'other local users'
ii) How to disallow both ssh and scp to 'other local users'