Adding outside external users to your domain

I was asked if an external user could be added to our domain. I know this is possible but I wanted to know a best practices approach to this. I want this external user to access some applications but not others. Should this user be setup as a guest and how could I deny them access to our shared drives and applications? This would all be done on a windows server 2008 with the client running XP.

Thank you