Locking Down Services

I need to build a W2K box that will confine users who may be accessing the server from outside the firewall. Are there Services I can disable that would prevent a user from ‘wandering’ once connected to the server? Or would Microsoft’s ISA productbe the way to go?