Last I looked into this, it seemed that masquerading as a custom launcher was the way to go. Any reason to avoid this technique?
Aside: As a long time Android hacker, it pains me to see iOS seems to do this better with "Guided Access" mode. Just look at the variety of apps which use it: Square Register, Envoy, etc.. Sorta sad it's not an Android platform feature by now.