Folder permissions, essentially, like Gooberlx2 said. You'd have to do a manual Deny on the parent folders for everything you don't want Origin to access. Say Origin runs under the account Play. You'd go to the folders where you don't want it to access (including drives) and add the user account Play with a Deny for Full Control. That way, even if your Play account is part of Users or something, they'll be explicitly denied access. You can do similar if you want to deny your Work account access to your Games folder. Direct all game installs to a parent folder for good measure.
If Origin tries executing under your Work account, you can remove the autorun or set the Origin excutable's permissions with your Work account as Deny Full Control.
The key here is explicit deny's on the ACLs. Just don't go overboard and deny your Play account access to somewhere critical. For added walling, you can remove the Play acocunt from admin access and use your Work/Admin account credentials whenever something needs Admin access.
Also, you can remove the Start Menu and Desktop icons as you see fit. If it shows up on all accounts it's buried in the Public area of Users.
Besides that, you're probably looking at something like Sandboxie or other software to ..well...sandbox Origin or the program in question.
Facebook
Twitter