You could consider creation of customer transaction that execute /SAPDMC/SAP_LSMW_INTERFACE with some customer system variants (CUS&xxx) so if you hide/protect enough fields user will only be allowed to execute it.
Giving whole LSMW is too dangerous, who knows what final users can do 
Regards,
Raymond