You can always listen to the content event for publishing and cancel it based on user role / page type as a workaround.

See http://world.episerver.com/blogs/Janaka-Fernando/Dates/2015/4/adding-custom-logic-to-your-publishing-step/

for some examples. It's pretty easy and fast to implement. It would be neat to have some more options to block copy on some page types and not only create.

Thanks for the link Daniel, that helps

I really think that the Access attribute should stop users from copying anything but the types they have access to. This seems like a bug to me, unless someone can explain otherwise. As far as I'm concerned "Copy and Paste" = "Create".

Anyway, something like this might work in certain situations - you can still copy, but not paste:

   public void Initialize(InitializationEngine context)
   {

            var contentEvents = ServiceLocator.Current.GetInstance<IContentEvents>();

            contentEvents.CreatingContent += contentEvents_CreatingContent;
    }       

 private void contentEvents_CreatingContent(object sender, ContentEventArgs e)
        {
            if (e.Content is IChangeTrackable)

            {
                if (PrincipalInfo.CurrentPrincipal.IsInRole("SomeRole") && !(e.Content is SomeContentType)) 
                {
                    e.CancelAction = true;

                    e.CancelReason = "You don't have permission to create this type of page.";
                }
            }
        }