By default, access to a published RemoteApp program is indeed granted to all users that have been “allowed” access to WSE RemoteApp. To change that behavior (i.e. to assign only a specific set of users access to a published RemoteApp program), simply open the server Dashboard application, go to the “WSE RemoteApp” page, click on the “RemoteApp Programs” subtab, select (i.e. highlight) the published RemoteApp program of interest, click on the “View the RemoteApp program properties” task (or you can simply double-click on the published RemoteApp program instead), and on the second page of the “RemoteApp Properties” wizard that opens you can set the User Assignment of the RemoteApp to specified users.