Have a look at chroot, which restricts a process (like the top process of a logged-in user) to a certain subdirectory tree (also called "chroot jail"). This subdirectory tree will a need a copy/link of every file, library, and application the user needs. Conversely, the user cannot access anything that is not in this subdirectory tree.
There are tutorials how to set this up on Ubuntu, e.g. here (first Google result, there are plenty more).
If you want a GUI login to land in a chroot jail, you'll have to modify the login process for that particular user in your Display Manager configuration (I guess that's gdm or kdm on Ubuntu, but I haven't used Ubuntu for some time).