Create a Label
Assign it to the Scope of a Role
Assign a user to that Role.
If this user tried to use that label, such as on a Managed Installation, you get an error "The following Labels are out of your Device scope:'Label Name'.
You need to be signed in and under a current maintenance contract to view premium knowledge articles.