Thanks for the help.
I haven't used FSRM before and it's pretty good, so thanks for that.
As I just wanted to control Chrome downloads in the ICT Suite for now, for 2 types of user (pupils and staff) I set the download directory in the pupil GPO to a designated, new share on the server and set the file screening to block .exe etc, so now when a pupil clicks a link to an .exe and so on, or tries to right click, save link as, it says in the Chrome download bar "Failed - Insufficient permissions" which is perfect. It doesn't prompt them to save elsewhere either, which is great.
For staff, I've just set their download directory in their GPO to another, new, designated share as I don't want them continually downloading to the local computer, downloads folder (and I couldn't find a way to prompt the user with a dialog box asking them where they wanted to save their file (within the GPO or work arounds), just like you can if you went into Chrome settings and ticked the box on a stand alone Chrome install!). Will probably change the default download directory in time to their home drive, but for now, it's fine, as staff will probably just load IE anyway, main one was the pupils!