Interesting topic, as I've just been asked to do exactly the same!
I've been asked to install Scratch, Build Your Own Blocks and Python/Python IDLE on our network. Scratch is harmless, as is Build Your Own Blocks. In fact, the latter is a fancier, web-based version of the former! I haven't had much experience of Python myself, but as you say, from a brief glance, it looks as though students could cause damage to the network/computers. I understand that quite a few secondary schools in our area have a dedicated computer suite, complete with server, for such applications. I've heard of VirtualBox too, which was next on my list to test ...
However!
The majority of our curriculum network is VDI based. Scratch is already installed on the network (other IT teachers have used it!) and I doubt Python will be difficult to install on the software template. Students only have access to their home folder - Access to Command Prompt, Control Panel, or others areas of the network have been disabled. Do you think it's safe to run Python on the network? To be honest, if a student did somehow damage the Windows 7 VM their session is running on, the VM rebuilds itself overnight ... or immediately, if prompted by myself.
Thoughts?