Create a seperate folder for the restricted account with a disk quota. Allow only donwload there, no execution rights. If needed, install the application as admin(istrator) than return to the restricted account.

When I became the admin of a cybercafé some years ago. I installed XP Pro and secured the systems. We never had any problem/infection since then. I let that speak for itself.