Was just thinking… You could also try setting “secureops” with chanserv. This will make chanserv deop anyone that is given ops if they are not on the room’s access list.

/chanserv set #RoomName secureops on