Why not just restrict them by using the local policies? i think there are setting for this in the policy editor. if not, use the net use command.
ex. net user "user account" /time:M-F,14:00-16:00
Substitute "user account" with an actual account name. AAs for the timer, if you already have a program to do this, you can add it as a logon script which is also controlled via the policy editor. i'm not fluent with the policy editor, but you should be able to find out more by googling.