This is has a much larger answer than you may expect, filled with a lot of variable pieces.
First, you need to consider the level of knowledge of your "user". If a highly-advanced user (or hacker) can sit at the computer... there is very little s/he can't do. A tech-savvy-user may know how to access shares directly, but probably can't do much more when presented with a basic "access denied" message. A typical user won't know how to access a network share unless there is a shortcut for them.
What you mean by "network shares"? Are you talking about an actual "Windows Network Share"on a separate Windows Server? If so, just set permissions to allow/restrict users as you see fit. As a general rule, if a user does not have permissions on a network share, he can't access them. Browsing to \some-server\share will result in a friendly logon prompt requiring a username/password (if he is not logged into a domain) or simply an "Access Denied" message (if he is logged into a domain and does not have permissions). Permissions could be assigned to the administrator to give him whatever he needs. As far as "hiding it" goes... this goes back to the level of skill the user has. You can't filter network connections by user, only by IP address, port, or other "network" attribute. Once the network connection is established, then you're at the mercy of the application-layer to maintain security. Unfortunately, there is no way to apply a group-policy object on firewall rules per-user.
If you want to restrict the "appearance" of network-shares, you can do quite a bit with group-policies that can obscure or limit the view of various network shares... but this discussion can get quite lengthy and really should not be done lightly.
If you're talking about a Network-Share on a "home-grade" appliance (router? nas? ???) with a partially-implemented SMB stack, you're really at the mercy of the manufacturer. If it doesn't ask for a user/password, there's not much you can do.
If you're talking about something else... we need more information.