You can't really do that with RDS desktops, you can with non persistent desktop pools and appvolumes so you can entitle applications to people based on a logon. You can look at fslogix and application masking to try and limit applications if you don't have access to those components
Implement Application Masking Tutorial - FSLogix | Microsoft Docs
I'm not that familiar with that yet, but based on what I read that may work in your situation.