Use software restriction policies ... easy ... very secure. After this, just make sure the user's only have limited accounts.

How to make a disallowed-by-default Software Restriction Policy