Allow Users To Login Locally, Shut Down, But Not Allowed To Browse

Hello

We have a Server 2008 R2 Domain Controller, we want users to be able to login onto the server and shut down. 

I have created a Global Group "SHUT DOWN SERVER" and added users to the group

Under 'User Rights Assignment' I have add this group to 'Allow Login On Locally' and 'Shut Down The Server'

This works grest, my issue / question is how do I limit any browsing or accessing tools? 

I know there is no difference with a user logging onto a desktop and browsing, they get restricted with security, but, if the same user logs onto the server to shut down, how do I restrict those staff from "looking around"?

OR - is there a way to set this if they login to the server in th group, the server automatically shuts down?

Thanks

B.