How to make profile to use only what's on the desktop

I've set up computers already imaged this was so I don't know how to do it.

How can I make a profile, that can't access anything unless they can access it on the desktop?

So this user is not using parental control. I want to be able to change settings in admin profile. But user profile they can not access anything unless it can be run from desktop. Thank you!!!