So to answer my question…
I don’t know if it is the best approach: In the custom post type I added capabilities to which only admin has priviliges like so:
'capabilities'=>array(
'edit_post'=>'update_core',
'read_post'=>'update_core',
'delete_post'=>'update_core',
'edit_posts'=>'update_core',
'edit_others_posts'=>'update_core',
'publish_posts'=>'update_core',
'read_private_posts'=>'update_core'
),
And then I also did that for custom taxonomies like so:
'capabilities'=>array(
'manage_terms'=>'manage_options',
'edit_terms'=>'manage_options',
'delete_terms'=>'manage_options',
'assign_terms'=>'manage_options',
),
So only admin can see it and manage it.
For the submenu in the capability parameter I just entered the capability which administrator, editor and author have in common (publish_posts).
add_submenu_page('edit.php?post_type=badge', 'Add new student', 'Add new students', 'publish_posts','add-new-students','bsp_add_new_students');