windows 2000 limit user access

I want to limit a user’s access to his own computer with win2k. I want him to be able to use already installed programs, but not be able to install any new programs. I think I can handle that with the proper read/write rights to directories. He will need read/write to existing application directories and no access to everything else. Am I right or wrong with this approach? Is there another way to do it?