User Policy

Would like to make a user and sometimes groups have certain rights.
I have read some acticles on Active diectory Group poicy. But I still don’t understand how to effect one user only. Meaning when John Doe logs into the domain he won’t be able see IE or network places on his machine.
Does this have anything to do with setting up new Organizational units?