Add Active Directory & Domain services Role | Promote to Domain Controller - Windows Server 2019

[@roya2045]

I have a user who needs to access a remote server via RDP/MSTSC I have given him VPN access he is able to RDP the server & use an ERP application . Now I don't want this user to access local drives on this server like D & E drives as this contains official documents. He should only be able to access the ERP application that is present on that system.for operational purpose. Also there are other users using this server for shared drive access for storing their data who are working on local lan, they should not be effected after making any changes. Please help me on how to archive this step by step process as I am a bit new to this. Its a request