So, back in 2014 I had a job managing a few computer labs in a job-training program for the Army.
We had some software - can't for the life of me remember what it was - that allowed us to manage what people could do on desktop Windows machines very-similarly to the way MDM lets you 'manage' company phones...

Stuff like limiting users to only running allowed applications.... There was a client program installed on the PCs themselves, and a back-end administrative interface that they all 'phoned home' to, to get their latest set of limits/config/etc...

I'm at a totally different job years later - most of them having no interaction with either end-user PCs or Windows - and we have an issue with people doing things-we-don't-like inside Terminal Server sessions... We want them to be able to use a handful of 'thick client' Windows apps (so no, can't do Linux-with-a-browser, it absolutely has to be Windows served up by Terminal Server), and that's about it...

While I know it's possible to roll your own using Software Restrictions, AppLocker or similar...

I'm wondering if anyone has any suggestions on a software package that works like the one I remember...

Oh, and if it's going to be usable it has to have NO cloud features, and NO subscription - just per-client pay-once-and-done licensing or similar. GPL would be best obviously, but this isn't the sort of thing that open source devs usually do, and especially not for Windows....