Moving Products from one Shop to a new Shop

Hello everyone. we are running Identity manager version 8.0.2.

we have two types of users in our production: employees and contractors. Both these types of users are cusotmers of a Shop inside IT shop (customer dynamic role: isinactive=0). We have entitlements related to an application XYZ published to this shop under a shelve "all user shelve".

There is a requirement to disallow contractors to request further products under this shelve. However, over the period of time both these types of users gathered IT shop entitlements from this shelve. 

I am thinking of moving these products to a different shop where employees are only customers but not only it will unsubscribe existing products from contractors but employees as well. Is there any simple approach to achieve this? which will not compromise existing products requested by employees and contractors and disallow contractors to request any further products from this Shop?

Best regards,