Threatlocker? Leaves MacOS out though.
https://www.threatlocker.com/products/threatlocker-storage-control/

Beachhead does this

Meets some of the requirements, I am a huge fan of toast, but obviously might be overkill for this situation. I have been to a local bar with only one register, and they used it. https://pos.toasttab.com/

DNSfilter.com, agent install.

https://www.amsys.co.uk/modifying-os-x-user-template/
I know its old, but may help.

MacOS has a locale directory template somewhere for new users, need to find that that could make something work right?

Are you just trying to have scripts run on login for each new user on each new machine?

@scottalanmiller It was on the homepage the day/time I posted it. Seems fixed now, but interesting.

I guess this is a good problem to have...

Hadn't heard of that... I've heard of Rezy, the reservation system, but not close enough. I like Toast a lot for the food and beverage service.