Blocking most access for the Student user

Hi guys.
So I want to create a system for my users(high-school students) to only be able to use what is required. We have a school setup where we've been using a third party to create admin blocks on the windows PCs we've been using. This blocks everything from installing programs, deleting certain files, changing desktop backgrounds etc. I want to upgrade my classes pc's to Pi4's because they're cheap, reliable and easy to secure in the classroom. Also MATE runs really well on them. The students use the pc's mainly for programming in Java and doing research on IT and the CAT syllabus. Is there a way to block most access on the pi for the students. Using Ubuntu will save allot on the cost of the new setup and with this additional security it might be the push I need to get the budget for the this. Also if I'm able to get it working well it would help out allot of other schools. The kids are smart and will be able to mess around allot without restrictions, especially on pi. I definitely want to use Mate, it's the best Distro by far for what I want to use it for. I haven been able to find anything on the forums to solve this particular issue.
Do you guys have any ideas?

Kindly,
Vincent

Welcome to the forum, Vincent!

Surely, regular Mate/Ubuntu/Linux users can be seriously limited in their access to the system. The question is whether regular user access is excessive for your students and which privileges have to be revoked from them. AFAIK regular non-root user access is considered pretty safe option.

Hopefully, the following link is helpful