I've gone to the length of adding code to my custom domU provisioning
script to set up a plain user for each created domain, with the GECOS
field containing the full name of the domain to attach to. Each of them
is a member of a group (I call it 'vscons'). I assign these users a
shell of /usr/local/bin/xencons-sh, which contains the following:

#!/bin/bash

/usr/sbin/xm console $(getent passwd $(id -u) | cut -d ':' -f 5)

That way, the users in question can't do anything other than attach to
the console of their Xen instance, and disconnection means immediate logout.

Keep in mind that Xen 3 requires a different script, as the domU
consoles are done quite differently than they were in 2.0.x.