You can protect the physical system by requiring a password to gain access to the hardware settings. You can also protect the system by preventing a user from using the abort sequence to leave the windowing system.
To protect the BIOS, consult the vendor documentation.