[Dovecot] How to enable COPY and APPEND commands separately

I'd like to allow a user to move messages between his folders on Dovecot IMAP account, but prevent move/copy from different accounts (Exchange in particular). Outlook uses "xx UID COPY 1 folder" and then "xx UID STORE 1 +FLAGS (\Deleted \Seen)" for internal moves and "xx APPEND folder" for external ones. I tried to achieve this with ACL, but i (insert) seems to control both. Do I miss something? Should I look somewhere else? Please help.