Go to server management-> Users->Properties->Account->Log On To
This will allow you to restrict the user to a specific computer.
Hope this helps.
I found a way because we had a similar situation.
First you have to log in as that user, or have them log in. Once the profile is created, you delete the “default user” folder from the doc and settings folder. That will stop anyone other than a person who has a profile created from logging in. Even an domain admin cannot log in.
You could of course do this via a login script directed at the pc, if you can’t actually go to the box and delete the folder.