If you wish to allow users to access Webmail, but not access IMAP, create a filter like this:
+imap:access_server_host, access_server_host |
This permits IMAP only from the access server hosts. You can set the filter at the IMAP server level using service.imap.domainallowed, or at the domain/user level with LDAP attributes.