What specifically are you trying to achieve? If you tell us that, we will be better able to help!
SE37 already has the ability to control its use quite well. There's an "Execute" activity independent of create/change/display, for example. Have you actually tried tying down SE37 to be as restrictive as you need? If it didn't work, how did it not work?
What do these users actually need to do? It might be that writing a custom transaction just for that might be that answer.
Steve.