There is a difference between preventing a user from seeing a start menu and desktop shortcut to an app and preventing that user(s) from being able to run that same app via the Windows (file) Explorer.
If all you want to do is hide the start menu and desktop shortcut(s) to an app(s) from user(s), then CUT
the shortcuts from the "all users" start menu and the public desktop and PASTE
them to the desktop and start menu for the user(s) of interest.
Show hidden folders/files - if need be: Hidden Files and Folders - Show or Hide CUT
For programs that you install:
edit: removed the path to the start menu in the ProgramData folder. It is a mirror of the All Users