Answer
By default, a custom menu item inherits the same Presentation Object (PO) as the Logical Unit it's created on, meaning there's no separate PO to grant/revoke it individually from everything else on that LU. To control access to just that custom menu specifically, assign it to a dedicated new Custom Presentation Object of its own — breaking the default inheritance from the LU's PO — and then grant or revoke access to that specific new PO within the relevant Permission Set(s). This lets you control exactly which users/roles see and can use that one custom menu item, independent of the rest of the screen's standard functionality.