RDEF CPSMOBJ OPERATE.PROGRAM.PLXPROD1.* +
UACC(NONE) OWNER(admin_group)
PE OPERATE.PROGRAM.PLXPROD1.* CLASS(CPSMOBJ) I(PAYUSR1) A(READ)
Or, if you prefer, you can give PAYUSR1 no access to programs:
PE OPERATE.PROGRAM.PLXPROD1.* CLASS(CPSMOBJ) I(PAYUSR1) A(NONE)