Given you are in IT you make the call to Microsoft and ask about that. Many schools deployed with titles like deepfreeze or other. Today we have browsers in incognito and other modes so you are left with more holes than a whack a mole board.
Microsoft used to have a group dedicated to education deployment. Ask for them.
I work in an education environment and these kids are very savvy. They have figured out how to put the computer in Safe Mode and make it impossible for me to track them. Does any one have any advice on how to Disable Safe Mode?