You have a lot of work cut out for you on this one. You're going to be locking down that laptop so tight that it will only do what you say it can do. Start off with ensuring none of the applications he needs require any more than basic privileges - not Standard User (power user) or Admin rights. NO access to the local machine (requires registry hack). You need to remove the capability to get into the Control Panel and also remove the ability to even see the hard disk outside of maybe the My Documents folder, unless you have that mapped as well.
Basically, this machine will no longer be able to function as a stand alone machine - it will only be functional when attached to the network.
Oh yes, if he has a personal email account that has webmail access or a hotmail/yahoo/name your favorite free email service on the web, and you allow him to surf the net, then you've lost the battle.
jdg