Thin client that is only allowed to run certain applications

Im thinking about testing out LTSP on a PPC server for a handful of PPC macs. Before I go ahead with testing and building out everything, is it possible to limit what apps are ran on the thin client? Lets say I only want the thin client to be able to run a web browser and adobe reader, is that possible? Almost like an internet café. I'm also open to other suggestions, maybe thin provisioning isn't the right track to head down if I want a really 'locked' down OS.