Super easy: don't give them a network and use a dedicated STB that's kept patched instead. Ta-done.