If we have all our map services published on one server, can we configure it such that our users can only see or access a only a subset of the map services?
You will set up one of three types of security.
After enabling security you need to first create the users and groups (either in the ags store,a management db, or a domain/ldap.
Then go to each service and enable for that group.
Note that you can only apply roles to services.
You need a separate role for each service.
Then put a different user in each role.
You have to go to each service to apply the role.