or if you want to make the setup really cool (and slightly more complicated

) make the user "new" a chrooted jail that only has the wanted commands in it's environment. then you can make the passwd and group files update by another script every hour or so.
You'd have to learn about chroot jails and such though, but it would be cool
Good luck
