Where the new user would be a member of the domain, denying access to everything else can be difficult or time consuming. Have you considered using Sharepoint to publish the pdf's? Sharepoint is built into SBS and easily accessed through remote web work place or directly. Within sharepoint you can easily set what files to which they would be allowed access as well as their read/write privliges on those files. Accesing the files with Sharepoint is also easier (done through a web browser with SSL), does not require a VPN, and is actually more secure than the VPN.