Easiest solution is to add the users in sudo to only be allowed to run the upstart commands you specify.
Users in the adm group would be able to do below:
%adm ALL=(ALL) NOPASSWD: /sbin/start app, /sbin/stop app
But replace with the commands you want to restrict them to.