you could always change their shell from /bin/ksh (or whatever) to that of the program. I did this for my sister so all she could run was a irc.

prolly best to use sam to do it. the program may need to be in /etc/shells as well, but YMMV
-p