I can answer the part of your question dealing with securing your filesystem.
If you wish to limit or completely disallow a user's access to a volume other than the system volume, you need to:
- Ensure the user is not a member of the local Administrators group
- Remove the default permissions assigned at the root of the volume to the
Authenticated Users group
The volume will still be visible in My Computer, but the user will get an Access denied message if they attempt to open it and certainly won't have sufficient permissions to format it unless the disk is considered removable media.
For the other users that do need access to the volume, you'll want to create an appropriate group such as
Data Volume Users, make them members of it, and assign it at least NTFS Read permissions to the root of the volume. Otherwise only Administrators will have access to the volume and they'll continually be hounded by UAC prompts.
For the system volume, you have to allow the user at least Read permissions. By default, non-admin users can Read the root and create folders in it, and will have full control of any folders they create. The simplest way to deal with this without breaking Windows is to deny your limited user the NTFS Create Folder / Append Data right on the root directory and specify that the permission applies to This folder only. That will defeat their ability to create anything at all in the root without prohibiting them from doing so in other folders they need access to, such as their user profile.