SSH tunnel logging?

If your friends are able to SSH onto your computer, they are using some of your bandwidth and it is therefore impossible to completely block them access to your Internet connection.

That being said, one solution would be to limit what your friends can do with your connection. You could set up a firewall that whitelists your friend's IPs and blacklists everything else. That way, your friends could SSH onto your computer but from there, wouldn't be able to reach any other IP than their own.

I have never setup a user specific firewall myself, but I believe it is possible to achieve with IPTables. Also, keep in mind that your users could still eat up a lot of your bandwidth by uploading big files on your server. If you specifically want to prevent this, you would have to limit bandwidth per user.

You want to make sure /etc/ssh/sshd_config contains

AllowTcpForwarding no

and then at the end of the file put

Match User yourusername
    AllowTcpForwarding yes

This will allow you and only you to port-forward to your hearts content, but as João said you wont be able to prevent them runing their own programs unless you also disable shell access.