I used to be able to recommend DeskLock... until Win10 came out.
AutoHotKey would do it, but if someone manages to kill it, it would no longer intercept keystrokes.
You can replace the shell (example below) and remap dangerous keys (further below) to make it most kiosk-y.