Match Group sftponly
    ChrootDirectory %h
    ForceCommand internal-sftp

% ssh somehost
This service allows sftp connections only.
Connection to somehost closed.

ssh -N -L 9000:localhost:80 somehost

Match Group sftponly
    ChrootDirectory %h
    X11Forwarding no
    AllowTcpForwarding no
    AllowAgentForwarding no
    ForceCommand internal-sftp