Local Group Policy

unfortunately, group policy applied locally applies to all users using the machine, including Admin.

It looks like you'll need to just use good old rights and permissions. Create a group for your TS Clients, then use the local group policy to specify what rights they have. Go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. Also use permissions for shares and folders.

good luck,

Apply the policy using Active Directory's OU.

Create an OU in your Active Directory Users and Computers. Move the terminal server to that OU. Select the properties of the OU. Go to the Group Policy Tab. Create a new Policy, then edit the policy with the restrictions you want. Save the policy. Select the policy, click properties, go to the security tab, insert your users and groups, select the "Apply group policy" check box.

Now this policy will apply to the Terminal Server and all the users and groups that you have applied the policy to.