If the user is not a local administrator you can enable Content Advisor in IE and set up a password. I use this method on workstations used as clock in/out terminals.
settings-internet options-content-enable content advisor
content advisor - general tab - create password
content advisor - approved sites - add allowed sites