how to create a user non-login but can use ssh -CD create local socks proxy

Question

I want share my VPS to other users, but they can only use it as a socks proxy server.

It can allow ther user do ssh -CD 1080 -N user@host. But he can never login to the server, and modify any file.

How to create a user like this.