Controlling access of portal users