If you don't allow "Logon to" all workstations, Windows NT allows you to configure a list of 8. If that is not enough, do it in a logon script.
For each user, create a file on the Netlogon share, where the user only has read permissions, called <UserName>.<ComputerName> for each authorized <UserName>.<ComputerName> combination. In the login script:
if not exist %LogonServer%\Netlogon\%UserName%.%ComputerName% PsShutdown -O