How can I create a user that can login through SSH but not on the local desktop in MacOS X El Capitan?
Set up your new User as a Sharing Only account, this gives them no actual account on the computer itself that they can log into…

System Prefs > Users &amp; Groups  


Click the lock  
Click the + sign to add a new User  
Set the new account to sharing only from the drop menu [stepped out on the pic for clarity]




Ref : Apple KB -  OS X Yosemite: Create a sharing-only user account

After Comments...
Apparently, this works, but only in combination with some other tweaks. 

You need to set up a new group, 'remote users'.
Add your sharing only user to that, then add that group to Remote Login

It seems that Sharing Only users by default have the shell /usr/bin/false and the home directory /dev/null.
Both of these values seem to be magic values for some PAM modules to block the user from connecting.
You have to change both and have the user added to the remote users group to make it work.