Typically, the way to lock down devices for businesses would be through Enterprise Mobility Management (EMM) solutions, e.g. Scalefusion, SureMDM, ManageEngine, to name a few. You can find a list of these providers here
With standalone applications, there are solutions such as the Fully Kiosk Browser & Lockdown and Kiosk Browser Lockdown, although both requires a paid license to access the lockdown feature.
For "free to use", I was only able to find HA Kiosk, although this was made mainly as a dashboard for home assistant, thus the app has no built-in auth and its settings can be accessed and modified even in device pinned mode.
Disclaimer: I built the app, as I was in need of a FOSS solution and Hendry's application has been removed from the Google Play Store
I made Webview Kiosk for a similar purpose. It addresses the OP's requirements of
by utilising locked-task-mode/pinned-mode.
Additionally, for my use case, protecting the settings page with authentication and blacklisting/whitelisting websites using regular expressions were needed, so that was the primary focus.
The app is fully free and open-source - you can find details on it below:
| Link Label | URL |
|---|---|
| Documentation | https://webviewkiosk.nktnet.uk |
| Google Play Store | https://play.google.com/store/apps/details?id=com.nktnet.webview_kiosk |
| GitHub Repository | https://github.com/nktnet1/webview-kiosk |