I want to add a group of users to the system who can only use and access the timesheet module, nothing more. 

The thing is, hiding menus or icons is not enough, if they would somehow have the correct path to a view which they shoulnd't access, the pop-up window with the no access rights message should appear.

I especially find it quite difficult to strip down the rights for this group regarding contacts and employees since those are implemented on the basic level for the internal user, so it seems.

Any idea to solve this without completly dismantling the internal user, add a ton of new groups and write several new record rules?