pam_userwheel is a tool that can be used to restrict login (su) to one (non-root) user by specifying a targetuser option.