"The laptops contain standard Microsoft Office applications, a link to the Division of Rehabilitative Programs (DRP) Learning Network, and pre-loaded approved bookmarks. This gives students access to Internet sites approved by academic instructors as appropriate for research."
In that case it would probably be good to issue to politicians - it might cut down on allegedly accidental leaks and would be of little immediate use to a thief who might "find" it on a train.
Then run them with only some variant of ChromeOS or similar on it.
Root FS is immutable, all content goes over a wireguard secured network connection. No network? No files.
"What do you mean you can't get in? It says here you're trying to access content just fine... You said you're where? Moscow? I'm sorry sir but we can't risk that."
"The laptops contain standard Microsoft Office applications, a link to the Division of Rehabilitative Programs (DRP) Learning Network, and pre-loaded approved bookmarks. This gives students access to Internet sites approved by academic instructors as appropriate for research."