RDWeb user access control

I know that you can limit what published apps a user can see once they log into RDWeb, but I cannot seem to find a good way to prevent unauthorized users from logging into RDWeb if they have valid do...