You could develop a custom SharePoint DelegateControl which checks for the current user and denies access to any ASPX page if it is your special user.
Such a control can be added via a feature to the placeholder "AdditionalPageHead" and stapled to any site of your choice without touching a masterpage or site definition.
This, rather simple, approach would prevent access to any *.aspx Webpage but wouldn't stop from syncing a list with Outlook, SharePoint Workspace or accessing it via the client object model.
More info on custom SharePoint DelegateControls and how to staple them on the placeholder "AdditionalPageHead" can be found here:
For an absolute foolproof way you should look into setting appropriate permissions as @Paul Schaeflein mentions, by creating a custom role definition which only allows API access but prevents opening pages in a Web browser.