Restricting new Devices in Network for simple Storage-Allowance

Hello there,

I have planned to use my current Server as a Backup-System for friends and family.
Of course, I trust them all, but I don't want to risk getting malware onto my Server, or any of my other devices.
How can I make sure that they can't access WAN over a physical LAN connection to my router, and how can I restrict their access to other devices in the network?
I would like for them to only have access to one program, which they will have stored locally on their own devices, which can communicate to a single shared folder in the network.

Many thanks in advance to you all,
SMT