Although AppLaunch may require certain rights to open files or executing secure commands, never forget that restricted users can use AppLaunch to start applications their Finder does not show. So if you deny a command line to those users, deny every command line, even AppLaunch.
Please be very careful with the privileged execution of shell commands! In most cases, there is no “undo”, so you can damage your system, really.