To the best of my knowledge, there is [not yet][1] any built in way (as of version 2.4) to provide access-control at the collection level. Mongo's ACLs go to the Database only. To do what you want you will have to move that `users` collection to a different database.


  [1]: http://docs.mongodb.org/manual/reference/user-privileges/