You could probably use a thin client rather than a PC and use Citrix or Terminal Services instead which eliminates many risks of placing a PC in a public location.
But, if you must use a PC, consider the following:
1) It sounds like you don't need to run many apps so start by locking down the workstation with group policy to only run specific allowed applications.
2) Configure the Windows Firewall to allow only that application in/out besides basic domain connectivity, updates, AV, etc.
3) Remove CD/DVD/Floppy? drives from the workstation and disable the USB mass storage driver to aid in preventing physical circumvention. You might put a cable lock on the workstation itself as well or place the PC in a locked cabinet with WOL configured so you can bring it back up remotely if it looses power.
4) Configure the workstation to not cache passwords locally and do not login to the workstation with a privileged domain account in case the workstation is stolen.
5) Other group policies can be configured to disallow access to the hard drive, restrict start menu programs, etc. Many of these are found under User Config -> Admin Templates -> Start Menu and Taskbar
6) Consider placing kiosks on their own subnet and restrict access to the rest of the network via firewall or at least ACL's on a router so they can only access the servers you choose on the ports you choose.
7) Consider setting up dot1x authentication on the switch and PC to prevent someone from unplugging the PC and plugging their laptop in instead to gain unrestricted access.