It's trivial to get around your lockdown with CD or USB boot devices unless you remove them physically.
It doesn't sound like you're using virtualization as it is intended, (More than one machine running at a time). Using virtualization as an OS menu choice doesn't make sense. If you're only running one system at a time, why not just install separate systems to partitions and clone/restore from another protected system if/when compromised. You could have 128 partitions of TinyCore or Puppy systems on a single disk. Use grub2 boot to ISO to protect base OS and reduce the number of partitions needed.
Have you thought about using PXE? Boot to a PXE server with a menu choice for OS desired. No hard drives needed at the workstation. Works great with gigabit network. Money spent on workstation drives can be allocated to gigabit switch, NICs and Raid drive setup in the PXE server. Much more difficult to override restrictions. Using snapshots, any running system hacking won't survive a reboot.
Best PXE configuration - Use ZFS as the file system. (FreeBSD or Solaris as the PXE server) With ZFS you can have the system reset to a known state at every shutdown. Use a shared drive or sync features to save bookmarks and files between sessions. Or use ZFS overlays so each user can install apps and modify at their whim while leaving the master intact. All system shared the same master base install to reduce drive space needs. Same thing can/should be done if you decide to go virtual by using immutable disks.
Otherwise roll your own from a distro's CD remaster as mentioned before.
Look at kiosk tools and distros for a start, like http://extragear.kde.org/apps/kiosktool/
Also the Oreilly Knoppix Hacks book has many tips for kiosks. Knoppix makes a great "fat" kiosk for more than just web surfing.