Need to create a restricted domain user account

Hi all,
I've been given the task of setting up five laptops for one of our offices that client's children can come in and use to learn how to email, surf the net and use office programs etc in a safe environment.
I need to have these domain joined so that staff can utilise them at times as well.

Can someone please provide a step by step for setting up a very, very restricted AD user account that can be used by the kids? Essentially I want to lock them out of absolutely everything, so they can only create documents, save, print and browse the web.

I'm aware it can be done through GPO (schools do it...) but how?

Thanks!