How can I restrict a user's ability to modify settings or install apps?
You can't... unless you manufacture the device by yourself.

You can't stop power users from flashing ROM which would flush your software based protection (even if you have embedded the solution in ROM to survive factory reset). Unfortunately, almost all devices in Market support it. If not, there are ways to hack bootloaders, too.

If you are still interested in software based solution, try contacting Soti. They provide such type of solutions at a cost.