segragating applications on W2K-TS

How do I install an application on W2K-TS so other users can not see or use it?

Environment:
W2K-IIS5-with TS running

Predicament/Need:
Multiple workgroups connecting to this 1 terminal server where each separate workgroup is NOT allowed to use other workgroup-specific applications.

Troubleshooting:
Have tried several installation methods with several different applications but all have resulted in that each and everyone has access to each and every application installed on the terminal server. Any suggestions for a fix?