When you say "remove zen" do you mean all the desktop stuff, like explorer?
I launch Nal explorer through a container script, and my users are in a "nal" group. I have a line in the login script which goes something like: if member of nalgrp then z:\nalexpld.exe. All I have to do is remove peoplefrom the group. I also handled workstation registration the same way.
As for any other bits, you'll have to look at what policies are accosiated with the user. He may rely (unknowingly) on user system policies etc, which would have to be left alone.
Andy