Limited Account

I have a Vista computer running on a Workgroup network with shared resources.
I would like to set up a guest account that can use limited functions such
as internet access and run Office applications without access to mapped
drives, or network printers.

If I change the name of the Workgroup on the system then no one can use any
of these resources. I need to have an account that is in the workgroup, and
one that is not.

Can anyone lead me in the right direction?

Thanks
JohnW