Hi,
It's really hard to protect win98. The best way is probably to say, "It broke last time you used it, and we haven't got it fixed yet..sorry." *grin.
You can set a boot password, it's required before windows even loads. You can also protect the BIOS with a password so that the boot password can't be disabled. Both these are set in the BIOS.
You can also use the policy editor to create users that have very little permissions. Set permissions for the default user, the one that would be logged on if they don't use a password at at all. I would suggest a user name for that account such as "kids" or "guest". Then don't set a password. They'll log in as kids/guest with no password and land on the default desktop that you've edited with policy editor. Be sure to create an admin account with a good password so that they can't get there. Policy editor is on the win98 CD but it has to be loaded on purpose. It doesn't get installed by default.
WinXP will solve all these issues as you can have much more user control. In WinXP, you can turn it on, set it as your internet gateway, enable Internet connection sharing, hook up your whole LAN to it and then hit the windows key plus L on the keyboard to "lock" the screen. To unlock the screen, one has to use the valid password for the account that locked the screen. This way you can leave it running to provide connectivity but they can't use it...forcing them to use the Mac.
I don't know about protecting win95, but policy editor should work on ME and win2000 has user accounts...you just have to create them and set their permissions.
Hope that helps...let me know if you need more