I've got a good idea:
Have in each usergroup's settings, "Can have an advanced profile page"
And then, do an if statement in admin/user.php so it finds if this user's usergroupid can have APP's...
If the user's usergroup CAN, show a field in the user's adminCP profile "can have an Advanced Profile Page".
So this way, it works two ways, you can have a usergroup allowed it, while specific users in it can't have it

.
To make life easier for you, have a page in the adminCP that displays which users can't have an APP but their usergroup can, because most likely these are the trouble makers.
A way the code for this page can be written:
First get usergroupids which can have an APP.
Then do a select from the user table, WHERE: usergroupid is in array of results produced from first query, and then: AND canhaveAPP=0
So that last part will take users who's usergroup allows them an APP but they specifically can't have one...
Don't forget though that things will be done differently for adding users in the adminCP as they don't have a usergroup yet...so you must take it that they're in usergroupid 2, but it could be 3 if COPPA, so that will require a little thinking.