I think if you create a stored procedure named abc that calls xp_cmdshell and grant EXECUTE abc rights to the given user, the user should be able to execute abc even if he cannot execute xp_cmdshell directly.