Terminal Services Security

My client is using Terminal Services for an external vendor to VPN in and update their software.
I have set them up with guest access, and using Windows Explorer set the permissions for directories to deny access (except for the directories they need to access). When I tested the logon within the network, their access was suitably restriced, but when I VPN’d in and used Terminal services the logon was locked out of some directories, but not others (that had permissions to deny access). How do I lock the logon down so it can only access a couple of directories when using VPN and Terminal Services?

Thanks for your assistance.
Kind Regards,
Justin Boxer