Hi Grigory,
None of these are answers to your questions, but perhaps they might give you alternative ideas.
When I have this sort of needs I simply put something like "sleep 3600" in the body of the script and be done with it. Now, hinted in this message it seems like your users are not so well behaved and you want THEM to submit a job of their choice, potentially one that they should not have, but YOU want to stop it from ever executing, then I have not attempted to achieve it with Slurm. If Slurm does not support such a thing, you may consider other ways to create a "jail" for the users for example with cgroup, container or other means so that they simply could not do anything.
Alternatively, if this is more about avoiding mistakes and adding convenience, you could create a script carefully crafted in the way you want/need (say "startnginx"), put it in everybody's path and let them run that command instead of dealing with slurm for this purpose.
Have a great weekend!