I'd recommend two accounts on the HTPC - one as administrator, and one as a standard user. Have the main 'Media' user as a standard account, so anyone who uses the HTPC can't mess it up (that proved very valuable on mine!).
Secondly, have a look at parental controls. I've never looked, but there may be some settings in there you can apply to the Media user account to prevent browsing, or only allow certain programs to run, for example.