Even without vCenter you can lock down the vSphere client to restrict what the user can do in it, although the granularity is not as great as it is when you have vCenter with 4.1. I can't remember what privileges you can set with ESX 4.1 and don't have access to a 4.1 server at the moment.
If you wanted to do it at a command line you could use PowerCLI with the following command that you could save in a .ps1 script file
Connect-VIServer -Server <name-of-your-esx-server>
Restart-VM -VM <name-of-your-vm>
Disconnect-ViServer -Server <name-of-your-esx-server>
e.g.
Connect-ViServer -Server esx01
Restart-VM -VM server01
Disconnect-VIServer -Server esx01
This will do a reset of the VM and not a clean shutdown so should work if the VM has crashed and the VMware Tools are not responding