@Jack Littlewort Two separate roles have been provided by the ASC application for the Alumni users 

• sn_hr_core.hrsm_alumni
• sn_hr_sp.hrsp_alumni

With the help of these roles you can restrict the alumni users to ASC portal only and can have page redirects in place to redirect them back to ASC if they try to access backend or other portals.

For more information please refer to https://docs.servicenow.com/bundle/washingtondc-employee-service-management/page/product/human-resou...

Hope this helps.