If you have the local infrastructure for it (or do it on cloud) VDI is an option. It's easy to snapshot, backup, and reimage, and if you store their files on a network drive a reimage won't affect it. You can also easily remotely access their machines to install software and inspect the machine, and you'll be doing so anyways as they shouldn't have root privileges.

VDI can be usably fast even with no GPU; for instance with a 8GBx8vCPU instance on an Ivy Bridge server I can actually watch 1080p Youtube with no frame drops.