You can use the built-in whitelisting feature. Set white-list in the server.properties file to true. Then add player names in white-list.txt, one per line.

Or, if you want more permissions flexibility going forward, install a permissions plugin like permissionsbukkit, permissionsex, or bpermissions. Then, for instance, in permissionsbukkit you could set the default group’s permissions.build to false. They can join the server, but won’t be able to do anything until added to a group with permissions.build true. This is how we do it on FSMC, but it can be overkill for a server with just a few people. It’s called greylisting.