Its important to remember as january mentioned that once someone has access to the machine it becomes very hard to completely secure it.
Information about grub2 password protection and password protecting recovery mode can be found here https://askubuntu.com/a/78051/71679
Some additional information that may be of interest in your case would be to look at the Bastille hardening program https://help.ubuntu.com/community/BastilleLinux and here http://www.bastille-unix.org/Reporting/assessment-report.html
Also you may be interested in the edubuntu version that includes LTSP. In an LTSP thin client environment, all software for workstations originates on the LTSP server. Whether you are repurposing old desktop PCs or deploying new thin client devices. LTSP allows you to maintain your entire computer network from a single point of control; from the operating system image on the thin clients through user authentication and file storage. By reducing your software footprint with LTSP, maintenance and support obligations are reduced when compared to traditional desktop PC computing solutions.
edubuntu http://www.edubuntu.org/ and more information about LTSP http://www.ltsp.org