User policies in XP can limit quite a bit, but you would probably need Windows Server to do everything you want to do without needing a 3rd-party app.
If you are doing this for fairly novice users, then removing shortcuts and Run from the Start Menu, and hiding My Computer and My Documents will probably be enough. The only icons you would want on the desktop are the Trash and Office icons. If IE isn't available in the Start Menu or desktop, then the user shouldn't be able to access it. If they happen to, you can add an extra measure of security by setting a false proxy server as Venom already mentioned.