Maybe something like "App Profiles" that have access to only a subset of the installed applications would work.
Maybe something like "App Profiles" that have access to only a subset of the installed applications would work.