I have a set of users, who need access to one single tab or object on the existing profile. How can i do it with out of box functionality.
You would want to clone the profile, remove the extra permissions, then assign the users to the new profile. There is no security feature that allows you to subtract permissions. Security in salesforce.com is additive. Users start with a base set of permissions, and then can be granted additional permissions via permission sets, licenses, and so on.