Here's one way:
- Open The "Source Control Explorer" TFS Window.
- Right click the root folder of a project where you want to have specific access.
- Choose "Properties"
- Click on the "Security" Tab of the the pop-up properties window
- Add the "Windows User or Group" of the user(s) you wish to deny to the "users and groups" list.
- Select the user or group in the "Users and Groups" window.
- Click on the "Deny" checkbox for whatever operations you wish to deny for those users.
edit
If you also wish to deny bug tracking, etc in addition to source control, there is a very similar set of steps for the "Team Explorer" window. It's too detailed to go into here, but it should be pretty straight-foward with the help of the MSDN documentation.