Create a user rule to allow the LINK.
In user 123WWW's user rules you would have:
ACCEPT XYZ123 LINK * * (or whatever link addr and mode you want).
Then, in the SYSTEM DEFAULT (note DEFAULT vs. OVERRIDE system rules) you would have:
REJECT XYZ123 LINK * *
You can also issue the VMSECURE QRULES command to verify the rules put in.