A couple of ways you can do that:
-
Set up a full install of Linux, then create a .ISO file of that install, then do a loop boot of that .ISO file (Ventoy makes that super easy to do, but you can do it manually without Ventoy)... they can make all the changes they want, but when it's rebooted from that .ISO file, it's back to the setup that created that .ISO file. That's also handy if they happen to contract malware... it's wiped upon reboot.