I prefer dedicated accounts for each job. You can use Group Policy to control interactive logon and batch logon. These settings are under Computer Configuration/Policies/Windows Settings/Security Settings/Local Polices/User Right Assignments.
You might find it easier to create a group and deny it the Log on Locally permission instead of listing each user.
