As any existing ChromeOS admin also knows, Google offers tons of options for restricting extensions, web apps, and Android apps, making it easy to productively limit what runs on your devices.
You’re not completely protected, though; with enough time and experience, hackers will always find a way. With that likelihood in mind, I’ve been testing a system called Conceal, which identifies suspicious websites and isolates them using a VM to prevent classroom disruption. So far, Conceal has lived up to its billing, successfully snaring potentially harmful websites while allowing safe and useful websites through
Other software vendors offer their own technologies and many filtering providers (including ILTPP Vendor Partners Securly and Delado) will let your keep everything under a single software by licensing your staff members. You can then move your staff to a different OU that has fewer restrictions. But if you do so, make sure to keep any adult or known malware distribution sites blocked. Better safe than sorry.