Restricting SSH shell access to Debian server

Solution 1:

You can use ForceCommand to avoid giving any shell access to the user.

 ForceCommand
         Forces the execution of the command specified by ForceCommand,
         ignoring any command supplied by the client and ~/.ssh/rc if pre-
         sent.  The command is invoked by using the user's login shell
         with the -c option.  This applies to shell, command, or subsystem
         execution.  It is most useful inside a Match block.  The command
         originally supplied by the client is available in the
         SSH_ORIGINAL_COMMAND environment variable.  Specifying a command
         of ``internal-sftp'' will force the use of an in-process sftp
         server that requires no support files when used with
         ChrootDirectory.

Solution 2:

If you're really looking to limit access, then I'd suggest using sudo and enable only the commands necessary for this user to administer the applications you choose.