KK, setup your computers as they were intended to be used. MacOS X is a multiuser OS. Stop thinking in single-user terms. For a small number of students, give each his own limited account. Allow each account only those functions required to carry-out their education mission. If you have too many students to make individual accounts practical, then establish a "Student" account. Give this account only enough privileges to run the apps that your students need. Do not allow limited users to install apps. Restrict which applications any user can access. They can't access use the commandline if they can't access the Terminal.
Thanks Scruffy and MisterMe
Unfortunately we have serious problems in getting this Apple lab to authenticate to the student sub domain; we have created a single student account for each machine and wish to lock the desktop so as to keep things clean and consistent for the generic "Student" user. More specific directions as to how to lock down the desktop would be appreciated.
You can't lock the Desktop. However, you can lock the Dock. You can restrict which applications you allow students to run. You can limit the Finder. Launch System Preferences. Everything that you need is available within the Accounts preferences pane. The options there is simple and obvious.