How to limit the number of users that can access a SharePoint site collection?

We're implementing a hosted Windows SharePoint Services 3.0 system and I need to limit the number of users that a customer can give access to a site collection. A customer should be able to manage his entire site collection. He should just not be able to delete the site collection itself or add more than a given number of users to the site collection and subsites.

It seems that with WSS 2.0 you could limit the number of users in a site collection using quota templates. In WSS 3.0 you can still limit the size of a site collection using a quota template but you cannot restrict the number of users.

There is not standard way of limiting the number of users that can be added to a site. Not without serious hacking or removing functionality from users.

One cannot eliminate the problem, only manage it:

• Use the peoplepicker-onlysearchwithinsitecollection property with Stsadm.exe to restrict the people picker to returning only users that are already added to the site collection.
• When the hoster grants permission to a user to access a site collection the hoster must add the user to that site collection.

Site owners can still add other users to the site using their fully qualified names or SAM account names.

You can periodically query SharePoint for the number of users added to the site collection (using the SiteUsers property of the SPWeb class). If the number added exceeds a specified limit you can notify someone or remove users automatically or whatever.

Hopefully future versions of SharePoint and WSS will have more fine grained permissions model.