To do this, you need to do 2 things:

1) Apply unique (not inherited) users  and roles to the subsite using the
administration pages for that subsite.
2) Change the users and roles for the top  level site  removing user(s) are you
wish.

Here is a really stupid question. What is considered a top  level site  in
WSS?

Top-level Web site
The default, top-level site  provided by a Web server or virtual server. To
gain access  to the top-level Web site, you supply the URL of the server
without specifying a page name or subsite.

Reference Link:
www.microsoft.com/.../
stsb02.mspx