Lock down single user Sever ’08

So I have a Server 08 box. I mainly use this as a storage sever. I do not have the funds to buy my media box as of yet and I have 5 roommates. So I want to limit their access to only the icons I provide on the desktop and the folders that I want them to talk talk to… ONLY READ ACCESS to anything I let them touch.

This box does not have AD (there is no point and I refuse to install it). How can I go about locking out a single user and not the entire machine.

I would like to see them use a list of 5-10 programs and maybe some “tokens” on the destop of the folders they can access… Any ideas?