AppStream offers an application only view. There is no desktop that the students are able to get to, no need to set up group policies or worry about opening other applications. 

Each session is a sandbox off a master image. After a session is ended the instance is destroyed.

Only users who you’ve given access to through GSuite/Azure will have access to AppStream.