Sorry, I don't actually have a way to do what you're asking, but I think this answer will be helpful nonetheless.
What do you mean by “does not have shell access”: do you mean that the user must only be able to use a few applications (e.g. a web browser and a mail client)? If so, you need to make sure that the applications won't inadvertently allow the user to run arbitrary commands. That's hard to ensure in practice.
This is generally known as a kiosk setup. There are many Linux kiosk projects, but most aim at making a kiosk machine, not a kiosk account that must coexist with other accounts.
A kiosk account is harder to secure. I think you'd have to use something like SELinux or a virtualization technology to prevent the guest from snooping on publicly-readable files (or else manually tighten all permissions, but there are things that are cumbersome to protect, such as the user list (
/etc/passwd)). I don't know of any project that offers this out of the box.
It should be relatively easy to set up a guest virtual machine with VirtualBox. VirtualBox has a kiosk mode where you can disable all VM controls in the GUI. Then you can run that VM as the sole application on an X server. Make sure to lock all other consoles when you're not using them, and voilà, you have a kiosk vt. Of course, the VM shouldn't be sharing any folder and its networking should be limited to outgoing NATted connections.
Inside the VM, you can run a kiosk setup, but that's not even necessary. Just take a snapshot of the VM and discard that snapshot after a guest has been using it. If you need to perform upgrades, start from the snapshot, upgrade, then make a new snapshot.
Coming back to having a guest user (and not addressing guest restrictions here), on the authentication side, there's nothing special to set up in each login manager. The whole point of PAM is to be independent of the session type. Make a user who can't log in normally, and allow that user to log in through a
pam_userdb line for the login method(s) you want to authorize (something like
auth sufficient pam_userdb.so db=/etc/passwd_guest in