Sure. The management policies for that account would include white listing the executables to run and proxying the browser to a non existent host and white listing URLs for sites they can visit.