AllowGroups ... ssh-ftp-only ...

...

Match Group ssh-ftp-only
        ChrootDirectory %h
        ForceCommand internal-sftp -d upload
        PermitTTY no