Prevent users from logon locally

Hi. I finished to setup remote desktop services(terminal server) on server2012.

clients can connect via rdweb and run applications.  

but when on local network clients also can do RDP to my sever and logon locally and manage my server.(run anything they want).

how i prevent clients from running things on my server i don't want them to run?

how i can allow only remote desktop services via web access but not local login to server?

thanks.