denying a user access from the internet

[Dave]

Hello,
    I've got a FreeBSD box that i have a user on who needs special console 
access. I've given him access to what is required, but i do not want him to 
be able to log in from the internet via ssh, telnet, or even a serial 
terminal if possible. Basically if this user isn't right in front of the box 
i don't want him accessing it. Is it possible to lock a user out to this 
extent, i know with ssh i can do an AllowGroup option and not put him in the 
group that would work?
Thanks.
Dave.