Version 10.2 of the web client (Web Access) will have a repository picker where the administrator can choose to hide certain repositories.  In some ways this is similar to the registry solution for the client, in that there is a list compiled on a client machine.

Note that in general there is a chicken-and-egg problem here.  The only way we can tell if a user has access to a repository is to try to log in, but that doesn't make sense if what you are trying to do is show a login dialog.  User attributes are stored in the repository, so you can't read them until after you have logged in, which is too late.