User access to Exchange email Only

I have a requirement to create user accounts in AD and to setup these users with an exchange email account which will only be accessible through the web OWA (users are using their own personal PC's or smart phones to access from Outside our domain).  However, these users need to be blocked from accessing any other Domain resources such as network files/folders/etc. if they ever got the chance to hack/access our secure network.

To simplify my life as an admin, since I have over 350 of these users, I have created an AD OU to separate these objects.  Is there anyway to allow the OU access to only email, specifically the OWA, and nothing else?

Would it be better to add these users to a group and limit access for that group?

Rjobe