If you are providing SnapCenter with the Vserver admin login, it is restricted only to that vserver. if you wish for it to have access to the cluster vserver, then you can use the documentation you have listed to restrict its rights to ONTAPI calls only.
What does your end goal look like for the SnapCenter deployment?