Take a look at the "Local Security Policy" section of the administrative tools in the control panel. In the user rights assignment section, you can add users to the "deny logon locally" policy. This will let them access your shares, but not log on directly to the machine.
The way I did it on mine was to make a new user group called "Network Clients", and put that group in the "deny logon locally". Then, when I make a new user, I can just make them a member of that group (and only that group - remove them from the main users group) and the policy will apply to them automatically.