Restricted access to Windows

Is there capability within Windows 2000/XP or a third party product that would allow me to give a user a login that restricts access to only one application. The application runs from a network server. I’m going to show my age here, but in Unix we were able to create a restricted shell and a user in this environment could only execute commands made available in their menu. I am looking for similar capability in Windows.