How best to setup additional user account in Win 10 for kids' homework?

My son has started secondary school and needs to use the family computer for homework now, however, the temptation of playing games is a bit too strong for him!

Currently I have Win 10 Pro with a single account (that we all use) that is password protected to first sign in, but no password when wake from sleep. This means he can't just turn on the PC and use it when he wants (like at 6:30am), but we can leave the PC sleeping so he can use it for homework when he gets home from school at 4pm, before we get home later... however, not enough homework is getting done.

My current thinking is to create an additional standard user account, no Microsoft account login, and then use Local Group Policy to restrict that account. I think setting the list of allowed programs will be easier than managing a very long black list.

I've read that there are parental controls baked into Win 10... from what I understand, I need to setup the new user account using a Microsoft login (my son, and daughter, have Office360 accounts at school); however, it appears I can only use parental controls to restrict MS Store programs (i.e. not Fortnite) and restrict web access using Edge, which is rather limited.

Are there other advantages to setting up an account for my son and one for my daughter using their school issued Office360 accounts, or should I just setup a single local account that they can both use for homework?

I'd presume the school 365 account would have lockdown for game install's etc anyway. My work microsoft account can't even be accessed off something that isn't connected to their remote server so

I find this an interesting dilemma as a parent.

I am not convinced group policy will cut it for you even with an allow list, the moment your son realises that iexplore.exe will run and fortnite.exe doesnt .... that fortnite.exe gets renamed :) Blocking and allowing are literally done on filename, there are no checksum/hash checks.

The Win 10 parental controls are a little limited and only cover a certain amount of applications and scenarios and are meant to be a step backwards on those in Windows 8.1 . If they do not offer what you need you may need to consider other options.

There are third party apps such as Qustodio , https://www.qustodio.com/en/family/downloads/ , which have a good reputation. The first device is free with Qustodio but if you want more than one you need to pay a yearly subscription. Others include NetNanny and Kaspersky Family Safe Kids etc.

You could look at a software firewall which you run on the PC, eg ZoneAlarm or Comodo, these can provide better granularity regarding Outbound connections and you could block application connectivity sometimes even on a scheduled basis.

Or you could go full on Draconian (as I have) and have an In-line Sophos Unified Threat Management (UTM) Gateway which has web filtering and the ability to block any sort of traffic from your home network to the Internet on whatever schedule you would like. With this method you would need to build a device, the home license is free, and make sure everything goes through it. And is the most complicated but gives you the most capability although it can stop everything working if done wrong.