How to set up device access restriction?

Question

linux

Good afternoon! I ask for help from the Linux gurus.
There is a server involved in receiving, converting and broadcasting video:

Distributor ID:	Debian
Description:	Debian GNU/Linux 8.10 (jessie)
Release:	8.10
Codename:	jessie

Reception comes from various sources, mainly DVB-S/S2 and the network. All this is done by astra from cesbo + ffmpeg.
DVB maps are installed in the server. Periodically astra writes device or resource busy to the log.
lsof shows 2 processes that have adapters open - ffmpeg and astra.
How miraculously ffmpeg does this, I still have not caught up.

[email protected]:~# ls -al /dev/dvb
total 0
drw------- 22 root root  440 Jan 15 14:13 .
drwxr-xr-x 19 root root 3220 Jan 25 10:32 ..
drw-------  2 root root  120 Jan 15 14:12 adapter0
drw-------  2 root root  120 Jan 15 14:12 adapter1
drw-------  2 root root  120 Jan 15 14:12 adapter10
drw-------  2 root root  120 Jan 15 14:12 adapter11
drw-------  2 root root  120 Jan 15 14:12 adapter12
drw-------  2 root root  120 Jan 15 14:12 adapter13
drw-------  2 root root  120 Jan 15 14:12 adapter14
drw-------  2 root root  120 Jan 15 14:12 adapter15
drw-------  2 root root  120 Jan 15 14:12 adapter16
drw-------  2 root root  120 Jan 15 14:12 adapter17
drw-------  2 root root  120 Jan 15 14:13 adapter18
drw-------  2 root root  120 Jan 15 14:13 adapter19
drw-------  2 root root  120 Jan 15 14:12 adapter2
drw-------  2 root root  120 Jan 15 14:12 adapter3
drw-------  2 root root  120 Jan 15 14:12 adapter4
drw-------  2 root root  120 Jan 15 14:12 adapter5
drw-------  2 root root  120 Jan 15 14:12 adapter6
drw-------  2 root root  120 Jan 15 14:12 adapter7
drw-------  2 root root  120 Jan 15 14:12 adapter8
drw-------  2 root root  120 Jan 15 14:12 adapter9

ffmpeg is running as user nadmin.

[email protected]:~# groups nadmin
nadmin : nadmin cdrom floppy audio dip video plugdev netdev

Judging by this data, ffmpeg cannot reach the contents of /dev/dvb, but somehow it takes devices. Hung up even acl at file system level. The picture does not change.
How to prevent ffmpeg from accessing device files? I would be very grateful for help and a kick in the right direction.
PS In the rules, udev found only one rule for these cards, which hangs up the video group. But even under such circumstances, there should be no access to the cards, as far as I understand.