You can lock them out of the app store completely, and only allow a list of approved domains that can browse to. I also had it shut everything down at 10pm so they couldn't spend all night trying to find workarounds. Worked really well, but it did require some work on my part to manage the installed apps and allowed domains though