I want to limit SAP user access to Transaction Code- SOST.

You can make use of T-code: SU24 and check objects related to SOST T-code. These are authorization objects for this Transaction - S_OC_DOC; S_OC_ROLE; S_OC_SEND; S_OC_SOSG; S_OC_TCD