In dovecot you can specify if the user has the right to use pop3 or imap by adding to WHERE clause (FIND_IN_SET('%s', services) %s is pop3 or imap services should contain a comma seperatet list of services (pop3, imap)
In googlemail the user can specify if pop3 or imap is activated for this account. this is alos a nice feature for pfa. an admin should define if a domain user can specify this settings.
also nice is allow_nets (http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/AllowNets)