I'm running WinServer2008R2 with Remote Desktop Services. I want users to have access to RemoteApp, but not RemoteDesktop.
Can permissions be granted for only RemoteApp?
Short Answer: No.
RemoteApp utilizes the remote desktop protocol and actually runs a complete remote desktop session whenever a user opens RemoteApp it just hides the full desktop and provides a container that the application runs within. So technically by using RemoteApp you are using Remote Desktop.
If you truly want a virtualized or remotely hosted application you are looking into the wrong technology. You really want to investigate App-V. It's a more expensive technology and came out of a company Microsoft bought a couple of years ago. Essentially with this technology the application is streamed to the client as bits and pieces are needed. There are also other options like the offerings Citrix provides as well.
Hope that helps.
After a quick search it looks like there may also be some freeware available to accomplish this. However a lot of people simply have login tasks that call logoff.exe. So when a user tries to use remote desktop it simply makes a call to immediately log them off. Kinda hacky but it appears to work.