Desktop files don't really seem like the place to enforce policy. As you say, it would make per-user settings clunky at best, if not impossible. It probably also wouldn't be all that hard for an inventive child to work around.