Hi Grig!
You can work around Local Security Settings -> Software restriction policies (that need to be activated first). There you are Security Levels who must be on Disalowed (default is "Unrestricted"). Now, deppending of the rights that user have on the .exe file U can allow or disallow to run it. Notice that many programs need other files to run, and this could make this task very hard. I tested this way on my computer and it works only for Internet Explorer :(
You may consider to use an application like those ones used on Internet Cafe.