Put no security restrictions at all on the laptop, except that no personal files should be stored on it. That way, it can be reimaged on a regular basis to remove unwanted or potentially dangerous software. This reimaging can be done over the network or in an emergency by physically swapping the hard drives.
Do not assume that you need to protect children from the Internet. This is a false assumption that simply creates headaches for parents, teachers, and administrators. Instead approach the computer the same way you would approach a piece of sports equipment or a musical instrument that is on loan to a student. Just as you wouldn't allow a student to use a school owned trumpet as a baseball bat, you can make rules about how the computer is to be used and you can enforce them without the need for software locks and censorship.
Step 1: Clearly define the rules. This is best done by a committee of parents, teachers, and IT experts. Resist all calls for censorship during this process, just make rules that the students should follow. Also define the guidelines for dealing with inappropriate use.
Step 2: Educate laptop recipients about the proper use of the equipment. Also offer education for parents and school personnel on how to deal with inappropriate uses.
Step 3: Monitor but do not censor Computer and Internet use. When inappropriate use is detected, and it will be, follow the guidelines.
Step 4: Maintain the laptops by regularly reimaging them. Hardware issues aside, they will run forever if managed this way.
This is the responsible and sophisticated way to run a laptop loaner program. Any other approach involving software locks and Internet censorship is just a challenge to students to try to route around the damage.
Many years ago, I ran a Wintel based computer lab for students using exactly this methodology and no PC was broken for more than about 10 minutes. All infractions of the rules were dealt with individually, so we punished the guilty instead of punishing everybody.