Control them all I must
As root you have TOTAL control over what your users can and can't do, BWUUHAAHAHAHAHA }:0>, er sorry, and not just running applications, accessing devices etc by assigning group permissions to them.
But you seem to want a sort of xfce/icewm panel with just the stuff they're allowed on it. That's probably what you need and they are extensible too - with a little effort you could really wow them with SuperKaramba on top!
Pretty boring stuff for your users if that's all they see though, but system response will be good as it not a bloated GUI like... erm. But kde is nice and they can create desktop items, of their documents, without doing any harm, and the menu will be unique to them.