How can I allow only certain wallets to deploy pool accounts

Hi I am using serum-dex. I am trying to control who, user wallet, can deploy new pool accounts to our dex. I was thinking I would use a whitelist account and hard code that address into our program. I’m not passing the pubkey for the whitelist address as an instruction to the pool program because I don’t want any opportunity for someone to pass a different whitelist.

What do you think? Is there a more secure way of controlling who can deploy new pool accounts?