[Michlib-l] OPAC stations

Hi all - We recently updated our public computers and added three new OPAC stations, bringing us to five total. We're trying to find a way to "lock down" what folks can access from these stations - ideally, we'd like them to only be able to access our website and Melcat. Our IT company recommended G Suite, but that is cost prohibitive for us at this point. Have any of you found an effective way to prevent folks from using OPAC stations to check email, social media, etc. that doesn't break the bank? Any advice is appreciated.