To enable untrasted remote user
use stunnel for actual port forwarding
then all you need is add the user to mysql.user table
with all privileges to 'N' - default
then insert following to mysql.tables_priv
use mysql;
mysql> select * from user where user = 'weak';
+-----------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+
| Host      | User | Password         | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv |
+-----------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+
| localhost | weak | 606768fd6665706e | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          |
+-----------+------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+
1 row in set (0.01 sec)
mysql> select * from tables_priv;
+------+-----+------+------------+---------+----------------+----------------------+-------------+
| Host | Db  | User | Table_name | Grantor | Timestamp      | Table_priv           | Column_priv |
+------+-----+------+------------+---------+----------------+----------------------+-------------+
| %    | bub | weak | a          |         | 20020402215738 | Select,Insert,Update |             |
+------+-----+------+------------+---------+----------------+----------------------+-------------+
1 row in set (0.01 sec)
that is all you shoud do and table bub.a should be the only one that user weak will be able to do
stuff with