We have mandatory profiles so they can't save anything locally or anything in their profile, they have network shares to save work which are only 5mb so they either save work or nothing at all, they also have restrictions to what they can save on them, no pictures video, applications ect.
They can't even right click.
I think the first thing you should do is lock down profiles so they can no longer store stuff in them.
We also have a 8e6 content filter which does a great job.
Lock 'em down they cannot be trusted.