Ok update time. Otzar kiosk mode ended up being quite simple once I was running the correct version, though all it does is disable the settings tab (still a very welcome addition, (looking at you, 12th grader who keeps changing the color to pink)) Bunch of chat-gpting later, and it seems like there are some options to make it easier to switch the Group Policy on/off, but I felt like I would be better off trying out the Inteset Software, instead of digging through all the policy manager settings again. Installation is straightforward. To activate the trial license, an internet connection is required, but it can also be done offline using a flash drive. A bit heavy on settings and not so straightforward, but once you get all the settings right, seems to be secure and easy to switch out of when necessary.