Blocking Features to tenants and user self provisioning

Hi

i have two questions

we want block certain features to the tenants such as call recording etc however the tenant's users still have access even though we disabled them from the tenant

and

is there a way to allow provisioning access to the tenant so they can add/replace phones themselves without us having to do it? currently when we log in as the tenant admin there is no option for provisioning we have to login as the system admin to make provisioning changes

Thanks
Robert
Systems Admin
MCN Online