I think you’ll be able to make a protected-mode version of ES fairly easy. Look at GuiMenu.cpp source code.

If you’re looking to make a whitelisted set of roms, you can do that by using a modified ES_Systems.cfg There can be a kids version and a grown up version. A script can be written that could take the file and do something like,
mv ES_Systems.cfg ES_SystemsKid.cfg
and take adult version

mv ES_SystemsAdult.cfg ES_Sytems.cfg
sudo reboot

That’ll reboot into ES using a different set of roms.

The script can be made so you can enter in your Capcom cheat code button sequence.