The restricted packages are currently only orderable by admins from the admin interface. However, v4.3 addresses both of your concerns via CORE-718. That is, clients will be able to order restricted packages through the order plugin, and the order plugin will only display the package group if it contains at least one restricted package the client can order.