By default, SSH tunnel command (using ssh or plink) will also allow user to interact with shell. Giving a specific login shell ‘/bin/false’ to the user will help to stop that concern.

useradd ssh-user1 -M -s /bin/false

Or

usermod --shell /bin/false ssh-user1

Cheers!