How to deny application access for a user/group?

I'm using Ubuntu Mate Docker image lscr.io/linuxserver/webtop:ubuntu-mate I can access the desktop via the browser. This works like a charm. However, I would like to restrict the abc (a group would also be ok) user. For example, how can I deny access of mate-terminal? Event better would be to only allow access to Firefox? The problem is that I don't know much about the Linux environment, so I have no clue where to start. So, any help would be appreciated!!