You can use thinapp and then provision the thinapp packages with appvolumes if you wanted to. You need something that would isolate them and thin app is really the only option outside of separate desktop pools and/or rdsh farms serving published apps.