Wow, Active Directory Much? There's so many ways to do this correctly using simple groups in AD. Or hell, why do these public kiosks even need to be on the same network?
Why are power plant (and other similar) control systems in any way accessible by the internet?
Why are credit-card processor internal networks in any way accessible by the internet?
Answer: because it's what happens by default, and people are too lazy or too ignorant to configure appropriate safeguards.
Windows is more than capable of providing a secure environment for this sort of thing. Wat you're looking at is some shoddy work that was probably done by some contractor years ago.
[1] A handful because many of us are remote. Mine is a EeePC.
A VLAN would keep these computers on their own network, and firewalls could be set up on the network side to prevent this stuff from happening.
A MAC filter would do nothing in this situation, because you are using their computer. Even if you had a MAC filter, these computers would be white-listed anyway.