Answer
Create a new Presentation Object specifically for this purpose — if the custom menu is a PL/SQL-Block-type custom menu, add every IFS view and API method the script actually calls as database objects within that Presentation Object. Create a new permission set (or reuse one already granted only to the users who should see the menu), search for and grant your new Presentation Object to it under the Presentation Objects by Component tab, then refresh the security cache and grant that permission set to the intended users. Finally, go to the custom menu itself and, in its own Presentation Object field, search for and add the same Presentation Object you created — this links the custom menu's visibility to that Presentation Object's grant, so only users whose permission set has been granted it will see the custom menu option at all.