We use Windows Terminal Services in Application Mode to provide controlled access to a business application. How can we restrict each user to one session at a time?

You can do so via a setting in the Microsoft Management Console (MMC) Terminal Services Configuration snap-in. Go to Start, Programs, Administrative Tools, Terminal Services Configuration. Select Server Settings, and in the details pane double-click Restrict each user to one session. Select the Restrict each user check box. This setting restricts each user to only one connection. If a user disconnects from a session and later tries to log on to the terminal server again, the server reconnects the user to the session that's already active. If a user is currently connected to Terminal Services and tries to initiate another Remote Desktop session, the server will disconnect the user from his or her current session and connect them to a session from their new Remote Desktop window.
—Randy Franklin Smith