Hi,
I''m not sure I understand the scenario but you could always "strip" the workstations of all I/O -devices like USB, Floppy, RS, Centronics Bluetooth, Infrared, CDR and DVDR. Just leave the CD-station and Network Adapter.
IF the users don't have to edit the files, take a look at Autodesk Streamline:
http://usa.autodesk.com/adsk/servlet/item?siteID=123112&id=8386400
I think this maybe more what your client is looking for?
Cheers,
Petri