So there's lots of ways to lock down iMacs so clueless (or malicious) young students don't mess up too many settings. I found the easiest way for me to manage is to just turn on the Guest User option which allows anyone to do a simple reboot to reset the machine to a pre-determined state.
I ensure the desktop wallpaper has a warning about saving local files to their school GDrive account and that restarting will delete everything. All iMacs are linked to my machine using Apple Remote Desktop which saves me a walk and multiple keystrokes by remotely rebooting or sending command line queries or commands. They are also binded by Meraki management profiles which allows another layer of control and observation.
I use the Dock Master website to create a custom dock profile which I then push out using Meraki. It works like a charm and a I can near-instantly update it by replacing the profile with a newer version and checkin-in all the iMacs. I also use custom profiles generated out of Apple profile manager for printers but I find Dock Master just so easy to use.
It's a bare minimum of dock items: Finder, Safari, iMovie, Pages, Keynote and some links to our SIS and school website. The Macs are so rarely used nowadays it doesn't really make sense maintaining a massive library of apps.
