Services also have ACL-s. If you don't want to grant access to all services to a user, you can set up individual service control rights. You can use
SetACL[
^] for example (from command line or even from an application via i'ts COM interface) to set ACLs on Services.