There is a difference between preventing a user from seeing a start menu and desktop shortcut to an app and preventing that user(s) from being able to run that same app via the Windows (file) Explorer.
If all you want to do is hide the start menu and desktop shortcut(s) to an app(s) from user(s), then
CUT the shortcuts from the "all users" start menu and the public desktop and
PASTE them to the desktop and start menu for the user(s) of interest.
Show hidden folders/files - if need be:
Hidden Files and Folders - Show or Hide CUT from:
For programs that you install:
C:\Users\
All Users\Microsoft\Windows\Start Menu
C:\Users\
Public\Desktop
PASTE to
C:\Users\
username\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\
username\Desktop
Be careful.
edit: removed the path to the start menu in the ProgramData folder. It is a mirror of the
All Users folder.