Parental controls blocking too much

I'm trying to set up parental controls for the iMacs in my school's computer lab, so that the students can't mess with the system preferences. The only application I want to block is system preferences, for just the "Student" user.

Multiple times now I've set up the parental controls settings so that the only restriction listed is that they should not be able to access System Preferences without the admin password. I set it up this way, lock it, and then log out of the admin user and log in as a student. As soon as it boots, however, I start to get messages that peripheral applications are being blocked, even when I try to open Chrome I'm told that it has been blocked by parental controls.

When I log out of the student account and back in as an admin, the settings clearly show that Chrome and every other application should be accessible to the student account. The same is happening with websites, which I set as "Allow unrestricted access."

What's going on? The settings I use don't seem to matter to the actual functioning of the parental controls. Am I doing something glaringly wrong?

Is there a better way to do this that doesn't involve parental controls at all?