How to properly install computers in stores?

Question

System administration

Hello!
We want to put a computer with 1C for the seller in the clothing retail store.
Questions:

1. How can I make it so that only certain programs can be started when the computer starts?
   
2. To prevent the seller from climbing social networks, you need to remove access to resources altogether. How to do?
   
3. How to prohibit the installation of "left" programs?
   

Computers will not be connected to the local network. They work independently.

Answer 1

Group Policies. Shell replacement.
Of course, do not give administrator rights.
And what confuses you that a person will rummage around in social networks?
Do you think he doesn't have his own smartphone?
Own - even worse for the buyer, the screen is small - he will be immersed in it.

Answer 2

1/ terminal access to 1C on the server via mobile internet + restrictions on the workstation
2/ make the seller's salary dependent on sales efficiency = he will work with buyers

Answer 3

1. The simplest way is to grant rights only to those programs that can be run. You can replace the shell. Of course, the user's rights are minimal, UAC is enabled.
2. To the Network in general - yes, elementary. Prescribe the left proxy in the browser properties, impose it with a policy.
3. See item 1. Minimal rights, no directories open for writing, USB blocking

Answer 4

1. www.howtogeek.com/howto/8739/restrict-users-to-run...
2. Set a static route on the machine instead of the default gateway to only those servers that you need. Then only these servers will be available, and no others.
3. Create a user account for the seller, without admin rights.