I found the following question, with a similar premise, however the answer to the question, was the question rephrased as a statement!
How do I allow RemoteApp but disallow Remote Desktop? In order to allow remote app, I'm seemingly having to add the users to the "Remote Desktop Users" group. This allows Remote Desktop.
I tried using the "TS Web Access Computers" group, however this does not give them the authority to run RemoteApp.
Where is the configuration to disable Remote Desktop, while leaving RemoteApp capabilities intact?