You don't need a separate Guacamole application instance for each user or even each VNC/RDP host -- each user in your Guacamole config has its own connection settings and operates independently of other sessions.
I've since gone through the setup of Guacamole and tried things out - indeed, its as you state, you can isolate users pretty well. I was able to set up 3 test users, each with their own WM, and independent logins on the machine .. and it works pretty well. I can see this as being a great facility for a small-office environment that just wants to run a single machine that services multiple users, each logging in with Android tablets or whatever other cheap browser-supporting devices they may have .. pretty neat, and you can't beat the ease of deployment: just point your users at their web URL, and there's their Linux desktop.
(I was even able to run Inkscape and Ardour on different logins, without too much fuss .. worked quite well!)
