CPS, the sheriff's department, the GAL or a licensed attorney CAN'T tell her to deny visitation. They could lose their job if they advised her to break the law. CPS generally only "jumps" on a case if the child is CURRENTLY in danger of being harmed. Since the child was back with mom, the report is going to take a backseat to emergency cases. They are also going to be slower to act because this is one parent accusing the other. Many times, these types of cases turn out to be false.
I have no idea if the OP is being honest or not, no one here does. My advice is the same regardless of whether or not I believe her story. If she is telling the truth, she needs to do whatever it takes to protect her child, including denying dad's visitation until she can obtain a court order. If it turns out that she is lying, she will deserve the punishment she will receive for making false abuse claims against dad in order to deny his visitation.