remote access

Depends...You can stipulate in the Ras Network settings that the client can only access the machines running RAS or Entire Network. I don't think that there is any way of specifying any other machines, unless to set User Level Security so that theycan't access any shares on any other servers?
Hope this helps.

If the machine is not a domain controller, and you want to give the user access to the machine they are dialing into, you could setup a local user account on that server.
The other way is to limit access to the dialin server for all users but that doesn't sound like what you want to do. Hope this helps

Remeber than when files are accessed remotely, the MOST RESTRICTIVE permission is used. Creat a new global group, add that user to the group. Configure all the root shares to give that group No Access, and configure the shares you want him to accesswith the proper permissions. I have no idea how complicated you're network is, but assuming you've got at least one server you want to grant him no access on, configure the C$ share (or $ share on the appropriate drive) with his global group to No Access and check "replace permissions on all subfolders". This should easily secure the entire server by only having to make a single modification. Hopefully you're network isn't too complicated...

Another possibility, though I don't know if thereis a way, is to you the policy editor to create a manditory profile for his account, disable network browsing but map a drive to the shares you want him to access. Since you're going over RAS, this may not be possible... or maybe it's just not possible at all... I've never explored it. At any rate, my other suggestion should work.