The list of Diagrams is retrieved by calling dt_getobjwithprop_u in the database where the diagram is.
So to hide all diagrams from certain users you could revoke execute permission FROM Public and grant execute only to the role that you want to be able to see the diagrams. (After every Service Pack it may be necessary to redo this).
Otherwise, you could really tempt Murphy's law by modifiying the above mentioned stored procedure to perform more complex logic to authorize or deny.
David Lundell
Principal Consultant and Trainer
www.mutuallybeneficial.com