So my solution would be to make a dedicated account, purchase a license on there, and hand it over completely to someone in charge at the facility.
If they don’t have someone who can take care of that for whatever reason, still make a dedicated account and restict apps/access rights via parental controls etc