Set OS X Server for remote-only administration
Unfortunately as long someone has physical access to hardware they can do pretty much anything with it. (depending upon they skills).

Your only semi safe solution would be to put it in a lock box.

Then set up password for log-in screen and password for idle (sleep mode).