default service settings are applied to all users who do not belong to
the admin group or the SFTP group. Deny all services from them on the
Basic and SFTP tabs.
Notice that denying the terminal service, denies also X11 and agent forwarding and shell commands for the specified group (unless some commands are explicitly allowed).