How to restrict document open in client application only to specified SharePoint group users