@danny.schumann 

Signature type are managed on an account level. Therefore, you would need to create a sub account for the three users that should be leveraging QES. This is common practice to meet this requirement.

In regard to sending exclusively via API, this is an uncommon request as the Docusign eSignature Web App is also build on top of the same APIs. Therefore, users will always be able to do things based on their permission profile, regardless of it being directly in the Docusign eSignature Web App or another integration. They will be able to log into their individual accounts and potentially send things from there. Unless you prevent them from logging into the Docusign eSignature Web App and only give them the option through your integration. In that case you may think of using a system sender for the integration and them not having individual accounts that can be used to log into Docusign eSignature Web App. If you assign them a “DS Viewer” permission profile, they cannot send envelopes at all, neither the Web App or through an API integration in their name.

Hello, thank you for your tip.

I've been reading through the support book for a while now, 
I have the Business Pro Pack, in which I can't make all the settings as described, can I?
Sub-accounts are not possible here. I can't really change much about the user groups.

Is the Enterprise Pro really necessary for this?

Thanks again