AD Basic question – restrict drive access for user

hi

How would I restrict a user from accessing particular drives and their contained folders.

Would I need to create a group that has specific permissions as all other users have access by default?

Also how do I create a group (if group is the correct term) that allows access to applications only?

thanks!