Yes, you would need 2 separate hard drives to do that, each unplugged while you install windows to the other, then you could just hide a letter in disk management.
If anyone knew what they were doing, they could simply go into Disk Management and assign it a letter, you would have to set it up so other users would have a standard account with limited privileges so they can`t make any changes to the system. And you would also have to password the bios.
Easy enough to do.
Businesses, Libraries etc do it all the time.