You can always restrict a kit to a <group name> by creating a permission when you create the kit, or add the permission by using /kit edit <kit name> and then creating the "permission name". No one without that permission will be able to redeem the kit , You can also set the "kit auth" level to that of the vips , all the info is in the kit documentation page,