Enable sftp but lock down ssh. Possible?

I have made ssh more and more restrictive, different port, only one user can log in (then su to root).
But I would like to have my users be able to use sftp.

I've been testing with giving users jailshell but of course they are not in the "allow" list for sshd.

Anyone have an idea how to do this?

Thanks
Gord in Montreal

 

Not Allowed

Thanks kernow,
But when I try that I get this in /var/log/secure
Nov 22 20:35:41 server1 sshd[3994]: User gordxx from xxxx.xxx not allowed because not listed in AllowUsers