My memory is hazy since my system hasn't been set up like this in years, but i think that if the user doesn't have permission to shutdown/reboot then those buttons don't appear in the exit menu. ie if the user were to type "shutdown -h" at the shell then they get an error message (don't remember exact wording).
I used to have to type su - c "shutdown -h" and enter root password to shutdown my PC before I gave my everyday login permissions to shutdown and reboot.
Hope this helps and apologies if my addled mind is deluding me
phunkymunky