authentication

spiderman

I am on TS6.5 on Win 2000, Say we have a scenario, where we can let some users to connect to the BOX, and access only one branch on the Teamsite, is this scenario possible, we want to give access to external users to use teamsite and also have access to the box, so that htye can run some CLT's if they wish, by saying so, i would also want any particular user to not access a particular branch or disable him to run any CLT's on any other branches to which he is restricted.
Can any one please help me on this, using Roles, Active Domain User and Group properties pleasee.
Thank you