might be just as simple as require_cap in portfolio/add.php
after discussion with MD the plan is to:
10:53 <moodler_> hmm plugins, we did something similar for grade import/expot
(relating to fourth point above)
closing this issue as resolved.
the outstanding thing about trying to figure out a way to enable or disable instances per role is trickier and not necessarily needed right now so i will open a separate bug for it.