Just an update - I was able to achieve what I wanted, but  only because the developers of the plugin thought to add a custom role to their package.

I was able to give that role editor access, then create a top level link to the package in the CMS admin area. 

Hi Chris,

I am intrigued to know how you solved this.

Am I right in saying that you created a menuprovider and then set the necessary authorization policy something like:

[MenuProvider]
public class SEOMenuProvider : IMenuProvider
{
  private readonly ModuleTable _modules;
    
  public SEOMenuProvider(ModuleTable modules)
  {
    _modules = modules;
  }
    
  public IEnumerable<MenuItem> GetMenuItems()
  {
    var menuItems = new List<MenuItem>();
    menuItems.Add(new UrlMenuItem("SEO",
      MenuPaths.Global + "/cms" + "/SEOTools",
      Path.Combine(_modules.FindModule("SEOTools").ResourceBasePath, "default"))
    {
      SortIndex = SortIndex.First + 25,
      AuthorizationPolicy = "SEOToolsAdmin"
    });
    
    return menuItems;
  }
}

Thanks

Paul

@Paul Yes, that is roughly it. But the Auth Policy set to the internal "editors". That way, the menu option appears if they (SEOGroup) are in editors, but they are still unable to access any admin related sections that aren't the SEO tool. 

        public IEnumerable<MenuItem> GetMenuItems()
        {
            var adminModule = new UrlMenuItem("SEO Admin", "/global/cms/customadmin",
                "/Episerver/Mogul.Seo.Manager.Package/Start")
                {
                SortIndex = SortIndex.First + 25,
                AuthorizationPolicy = CmsPolicyNames.CmsEdit
            };
            adminModule.IsAvailable = context => true;
            adminModule.SortIndex = 100;

            return new List<MenuItem>(3)
            {
                adminModule
            };
        }

Unfortunately, it does mean the SEO Link appears to all editors, but those not in the SEOGroup will get an access denied. It also means SEOGroup are automatically editors - though or our puposes, I think that  is OK.

Thugh I do need to remove some hard-coded elements from mine.