Thanks André
Just in case anyone else is looking for the solution on a QNAP device.
Initially I looked at having multiple targets and allowing connections to specified IQN's and mapping LUN's to targets. This seemed to work however there was a big problem in that on the QNAP you cannot modify the allowed IQN's list on a target while there are any devices connected to that target which is a bit unpractical in a production environment.
Following on from your suggestion I did a bit of more digging around I found the required function under "iSCSI ACL" on the QNAP device, this allows you to set RO, RW or Deny permissions to individual IQN's on a per LUN basis. This seems to hide the "denied" LUNS from ESXi hosts and can be modified while ESXi host is connected to target.
