I'm currently working on a small CMF based on Django and I've implemented threaded comments there which seems to work fine. You can grab the latest source at http://github.com/kovshenin/Juice The module you're interested in is juice.comments. The threading is illustrated in the news-single.html template which is called from the juice.front.views.single view. Note the level and indent parameters which are passed to the template:
# comments
p.comments = Comment.tree.filter(content_type__pk=ctype.id, object_id=p.id)
for c in p.comments:
c.indent = c.level * 50
The p object is of type Post which is passed on to the template.
Now, regarding restricting threading to other people than the admin/owner. In that same view I illustrate how to process the commenting form, where you can clearly see that I'm looking for the parent comment if one is supplied. You'll have to add some logics there and check for current user login and his privileges, and if they're not set, use parent = NULL. In the template just hide the reply link ;)
Hope that helps, and beware that I'm constantly working on this project, 5-10 commits every day, so keep an eye on what source you download. The documentation currently contains only the way posts are handled (already partly outdated), but I'll be updating that constantly.
Cheers.