Super easy: don't give them a network and use a dedicated STB that's kept patched instead. Ta-done.

I do that, but it would be nice to have a single device/remote and faster UI.