My recommendation, is to create a full chroot login environment for the users when they log in. This is similar to what apple and OEM android manufactures do to their devices. http://en.wikipedia.org/wiki/Chroot. This lets you create a specific environment for each user that logs in with limited privileges.
This way you can lock them down to only a specific section of available tools. Even if they have write access they will not be able to affect the root file system and any thing running there, with out some significant effort.
The following links will help you along the way
Just like rooting, or jail breaking the iphone, android devices, requires sophisticated knowledge of programming to exploit privileged process, it is not very easy to do.
This tutorial for Ubuntu explains what a change root / chroot environment is and how to create it.