This may sound silly. Is there a way to give the user only access to SiteEdit but not the CMS? I understand they are the same ID and access. I just want to check whether there is any easy trick to achieve this. Don't ask why I need this :-)
The Tridion security model enforces security at the very back-end (the CM core) and not the UI you use. This has great advantages (only one place to manage security independently of how you access the content) and disadvantages, like not being able to do what you ask for.
You could potentially achieve this with IIS security on the CME website... But that will probably cause trouble with shared resources.
I don't think you can achieve this.