How to restrict access to Enterprise Vault for user's own Mailbox?

How do I restrict a user from his own Enterprise Vault and create a new one for him? 

This is for ringfencing purposes. The user will be transferring to a different department and needs his EV access removed but not deleted. His manager should have access to his old archive and a new one created for the user.

I can't seem to remove the inherited permissions from Exchange and I am not sure if zapping would help.

Anyone have an idea? I don't want to mess up the user's account so I am prepared to do this first on a test account.

Thanks!