Well ... if he doesn't want anybody to access the computers then he could put a BIOS password, that would solve the issue of security at boot up, so if they do indeed restart, they would still get nowhere ...
But it still doesnt' solve the problem where you are able to remove safe mode from the start up selection list, i don't think that there is a way, atleast not to my knowledge ...