Block SSH tunneling to IP, allow only for certain users

I need to setup SSH to block all access to a certain IP on port 555. Only a small group of users should be allowed to tunnel to that IP. Currently I have the following stuff in my sshd_config

Match User bob
        PermitOpen 1.2.3.4:555 5.6.7.8:555

The question I have is, how do I deny all other users access to this tunnel? I dont see a denyopen, or restrictopen thing in sshd_config.

You could do it with a firewall on the SSH box:

iptables -A OUTPUT -p tcp -d 1.2.3.4 --dport 555 -m owner --uid-owner bob -j ACCEPT
iptables -A OUTPUT -p tcp -d 1.2.3.4 --dport 555                          -j REJECT

Disable TcpForwarding for all users by default:

AllowTcpForwarding No

And make an exception for user bob:

Match User bob
        AllowTcpForwarding Yes
        PermitOpen 1.2.3.4:555 5.6.7.8:555