How to limit a linux user as much as possible?

Question

linux

It is necessary to create a user who will be able to:
- use one browser and have access to four sites on the Internet, which will use flash web applications. Internet connection by wifi, the network will be configured to automatically connect when turned on.
- have access to printers, scanners and copiers at the level of a regular user.
- store files on a PC, the total volume of which should not exceed more than 1GB on a PC.
- such software as an archiver (maybe there is an extension for Thunar?), OpenOffice and LibreOffice should be available for work.
- access to one USB flash drive.
Everything. Files cannot be stored on the desktop, in the xfce settingscan't get stuck. In general, you can no longer run anything other than this. There will not even be a menu on the xfce panel, only a browser button, a clock, a layout, a PC shutdown button, a logout button and that's it.
Disks, other flash drives and other devices cannot be connected. The sound on the PC should not be. In general, everything that can be done was listed above, everything else is impossible.
The OS will be Debian 7.6 (stable) with xfce4.
I partly understood what to do. I allocate 1 GB of disk under /home, add the user to the following groups:
lp - Access to
scanner printers - Access to scanners
xfwm - Login Manager
I am not a very confident linux user in terms of user management, tell me what other groups I need to add user, so that everything works like a clock?
In terms of one flash drive, I think you need to dig towards the restrictions on the device id.
Tell me please. Thank you.
UPD: /home does not have to be 1 GB, Quota can be used .
UPD: In order for the user to be able to work normally with other software, but not be able to edit the xfce settings (for example, he did not delete the xfce panel), we set the read-only right on /home/worker01/.config/xfce4/.

Answer 1

SELinux?