You do apply it to groups or users via a GPO (Group Policy Object) Locking down is not as simple as it seems though - there are many shortcuts which can be used to jump from the 'sandbox'.

GPOs can be applied to Computers (top half) or users(bottom half of the GP editor) but not both in the same link. Most of what you want to configure is in the bottom half (hide My Computer, hide Run, hide Control panel etc...etc...). Force them to log on as guest and rename or remove things like cmd.exe, ftp.exe .....etc....

A determined and knowledgable user may still be able to subvert your box by booting from CD and changing the admin password or just using the box from a bootable distro like knoppix. BIOS password the machine and remove CD, Floppy and USB disks from the boot sequence.