Sorry, ma dude. This is 100% incorrect. Been doing this a long time, and have managed massive numbers of desktop sessions for enterprise end users.

Lookup dconf. It’s the tool that manages the underlying configuration engine for Gnome specifically.

Outside of the granularity there, you could also just lock everything to a group and exclude logged in users from that group. That’s a very simplistic way of explaining itz but achieves the exact same thing. You build a base image with only the apps the user needs, set execution to an inclusive group that user belongs, and everything else to some other groups, and there you go. Dead simple.

Of course that’s not how you’d do it for an org with thousands of users, but you get the point.