I don't think so, but I suppose it would be easy enough to add code to check someone's mlev. Doing something on a per-user basis would be a lot tougher.
Unless you were feeling rather ambitious and used the UserGroups MOD to manage the permissions...
I've found that once you get the UserGroup MOD up and running, its not that hard to check if a logged-in member is part of a particular group. In some quick-and-dirty testing I've been able to hard code the group ID's I wanted to check for. I'm planning on eventually developing something a little more elegant.
Wouldn't it just be easier to stop em at pop_upload_new.asp?
Something like: 5 if strDBNTUserName <> "" and mlev >2 then
I know, they'll still have the button. But you should probably do it anyway as an extra security measure, so it'll free you up to play with the button code later.