Currently, it is necessary to execute reference from API when Flow refers to Office 365 users. Thus, we are concerned that there is no restriction to disable referring some users. For the security protection, I hope the feature to make the restriction of Office 365 users that can reference from Flow.
For instance, it is possible for general users to make disabled other users as a reference by using the Address Book Policy via Exchange in Office 365. In order to improve usability, please provide the availability that makes limitation to reference for Office 365 users through Flow.