There are cases in which you want to exercise great control over who is allowed to use your application. You might, for example, be required to check the user's network credentials, validate client-side certificate or check a license server before the platform application is even launched.
A platform application is typically started from an executable launcher (Windows) or shell script (Unix). This invokes the org.netbeans.core.startup.Main.main method. However, as described in the Module System documentation, you can use the netbeans.mainclass system property to specify a different class to run at startup.
This main class must be present in the startup classpath (you can put it alongside core.jar in platform8/core or similar) and must have a main method. The main method can then invoke whatever authorization logic you like. If it fails, you'll probably want to show a dialog to the user and call System.exit. If it passes, you can then simply invoke org.netbeans.core.startup.Main.main yourself to continue the normal NetBeans startup procedure.
If you simply want to enable a single module based on some criteria (for example, the existence of a license file), you can use ModuleInstall.validate().