Making CPanel login separate from all-access ftp login?

[whataguy]

I'm a reseller who wants to give his clients access to CPanel. I also want to give them ftp access, but not to every directory on the server, as some of them will contain config files for custom apps they don't need to change.

However, the default CPanel login automatically doubles as an all-access ftp account.

Is there a way to assign users a CPanel login that is not the same as an ftp account?

Thanks for your help.