Hello,
as a matter of fact you can't restrict VA11 according to plant, even with additional coding, because of the way the transaction flows: when you run VA11 you have to enter Sales Document Type and Sales Organization, but at the moment the system don't know which plant wll be determined (since you can have different plants at item level related to the same sales organization).
You can think to create a custom authorization object containing the plant, and add a custom authority-check control in the user-exit of Sales Documents, such as MV45AFZZ in USEREXIT_SAVE_DOCUMENT_PREPARE in order to check the plant at item level for each item of the document.
Consider also that possibly, a Sales Document could be saved without items: in that case you wouldn't have any value to check during the authority-check.
Best regards,
Andrea