Restrict Access to CL01 and CL02 by Class Types

I need to restrict tcode CL01 and CL02 depending on the class type.

For example:

--- User01 has access to the material class type

--- User02 has access to the equipment class type

--- User03 has access to both material and equipment class types

--- All these users have display access to all class types

Therefore,

--- User01 should be able to create and change material classes only and not equipment classes.

--- User02 should be able to create and change equipment classes but not material classes.

--- User03, on the other hand, can create and change both material and equipment classes.

Should I get an abaper to check for a userexit to perform the auth check? How can I avail the use of auth object C_KLAH_BKP? Where can I create this auth group and how does it tie to the different classes?

Please advise.

Thanks in advance!