[AccessD] Access Security

What is the best method to lock users out of the BE tables and (linked) FE tables in an existing Access 2003 application?  The client wants users to be able to create ad hoc queries, forms and reports in the FE, so using an MDE is not an option.  (They do not use the separate "ad hoc" database that I provided them :-(  Only "super" users should have the capability to access data tables directly

I found some 3-year-old security info in the archives, but was wondering if opinions have changed since then.  

Thanks,
Barb Ryan