What you could try is to use SBC mode and set the immutable flag on config.g on the linux side. Then you would need to be superuser to unset the flag before changes to config.g would be saved. I would not recommend this though, because its hard to debug when things go awry.
And even if config.g.would be locked down, users can change roughly every aspect of machine configuration dynamically via gcodes. So the next step would be to only allow "reasonable operator" and "admin" commands depending on who uses the machine -- and there is no facility for this. Its a can of worms.