Still on Windows XP?
If your organization has considered an OS upgrade but hasn’t pulled the trigger yet, check out this Windows 7 migration guide.
In Windows Server 2003 Group Policy, I think you will find that Software Restriction Policies are the way to go. Using SRP, you can either define a list of .EXE files that your students are allowed to run and only allow them to run those you've defined, or else explicitly deny access to only a few .EXE files: sol.exe, freecell.exe, etc. There's a good tutorial out on WindowsNetworking.com that will step you through setting up a basic SRP for an environment just such as yours.
This was first published in November 2005