Allow access to a single application only when accessing remotely
The closest I can think of in your case is to go to System Preferences > Parental Control and create a new account (or use the “Guest” account). Then, set the following restrictions (my OS is not in English, so the exact terms might be different):

Under Apps:


Use simplified Finder
Restrict applications, only checking Safari from the list.


Under Other:


Prevent password change


Then, log with the new account. Clean up whatever right-hand menu item you don’t want your friend to access by holding command while drag-and-dropping them out of the menu bar. Launch Safari (from the Apps folder in the dock) and log out without quitting Safari.

You might want to put Safari in fullscreen mode, but then it won’t appear on the first screen when people log in, they’d have to click its icon in the dock.



If you want to launch apps or scripts at startup, or if you want to edit any account preference, you can do the following:


Log into the controlled account
Inside the Finder, select Use the complete Finder under the Finder menu. The system asks for an administrator login/password.
Open a new window, go to Applications and launch the System Preferences. Select the Allow once button, then type once again your login/password.
Go to the Users and Groups preferences pane.
Click the lock, and enter administrator login/password (one last time!)
You can now edit this user opening items. You could add Safari or whatever script you need this user to launch at startup.


Alternatively, you can also create the controlled user, log in and setup the account to your liking, then log out and, from an administrator account, turn on parental control.