The universal server install should be installed on the database server, the client and Chimpegration view client should be installed as on a regular desktop on the application server. If you want to lock Chimpegration down for only certain users, these are the name of the files you will need to restrict:
ChimpegrationViewCom.dll - in the custom directory (please note this element is relevant only for Professional users and does not function in the Basic version of Chimpegration)
both are found under Blackbaud\Raiser's Edge
You would typically use Windows Active Directory permissions to lock these files down.