Restrict "restricted profiles" even more: disallow the settings app.