You could create a dummy user that can read and write everybody's files. I know this is dangerous but bear with me. Then you change the program folders so they are only readable by this dummy user. (apps on Mac are really folders). So let's say the app is dreamweaver mx, you right click dreamweavermx.app and pick get info. Then you make it readable and executable only by the dummy user and your admin accound of course. Nobody else can read or execute. Now you create a shell script that everybody can see and execute that is SETUID to the dummy user and the shell script runs the program. Now your students can execute the programs but they cannot copy them and paste them to the usb drives. Lastly, you need to set the setuid bit on your students' folders so that files created in their home folders by applications that are running setuid'd to the dummy user are still writable and readable by the students.
I know it's a hack but it could work. Be sure to set an obscure password for the dummy user. A determined student will get around this but it might work. Remember the first step in security is to prevent access. Barring that, you are hoping these students aren't motivated with time on their hands.
Oh. Here's another thing. Put the apps on a networked drive. They are always run from the networked drive. There are aliases on the students' machines pointing to the apps on the networked drive so they can run the apps but they have to surf around to find the apps. Use parental controls to limit their finder so they cannot browse the network (I think it's called "use simple finder").
