Put the users in their own group.

Remember this feature is for a system with a Windows Server so you may be thinking about something else and didn't tell.
Bob