You need to utilize appropriate security principals. Create server logins and database users (and database roles for grouping permissions [and server roles if you are using SQL Server 2012]), and grant these principals the necessary permissions to do only what they need to do and nothing more.
Securing an instance/database is a very long topic, but a great place to start is Books Online. See this link at the bottom to view all the possible securables you can
REVOKE permissions on.
You will most likely be concerned with Database Permissions with your described scenario (that doesn't mean you can ignore server permissions, but
CONNECT may be all these aforementioned users need on the instance-level).
If all you want to do is allow the user to query data in a certain schema (for example), you'd simply do the following:
Note: It is best practice to create roles to house applicable permissions and then add users to roles instead of individual rights to users. It will become a management nightmare if you do the latter.