SAP_ALL with S_TABU_DIS constraints

Hi all,

Could you explain me is that possible to create user with sap_all and restrain him to object S_TABU_DIS?

I want that user has sap_all profile but also he can't maintan or view tables from HR (ex. PA0000, PA 00001 etc) via SM30 or SE16 or SE16n. Is that possible?

Could you give me instructions step by step how configure it?

I will be grateful.

thanks

Michal