KDE had a policy editor back in v2.0... honesty I never really followed whether those features stuck around. But the simple version is to lock down write access to folders in $HOME, such as .config or similar. Linux already prevents most users from installing programs over the system directories without root, but I'm not sure if you can restrict new programs with +x in $HOME unless you write-lock the whole folder... Someone with more network admin experience probably knows this :)