Answer
If the command is backed by a specific projection action, control it through the Permission Set instead of trying to hide it visually — grant or revoke that specific action on the relevant permission sets, and only assign the permission set with it granted to the intended users. This won't make the button itself disappear for everyone else; users without the grant will still see the command but get an Insufficient Privileges error when clicking it, which is expected and by design rather than a bug. True visibility-based hiding per user isn't achievable here through configuration — that would require a custom attribute driving a visibility condition, which isn't available on assistant-driven or virtual-entity/query-backed pages like this.