i5/OS provides an exit point for the FTP client. This means that you can have i5/OS call a program of your own when someone tries to start and FTP session and when they try to perform various operations. Your exit program can then allow or dis-allow the request. The exit point, QIBM_QTMF_CLIENT_REQ, is documented in the i5/OS Information Center here for a general overview, and here for the specifics of what information is provided to your program. The second parameter passed to your program is the operation requested (Start, Send a File, Receive a File, etc), the third parameter is the name of the requesting user profile, and the sixth parameter additional information on the request (for instance, for a Send File request the sixth parameter gives you the name of the file they want to send).
Hope this helps,