Small (charitable) business - user accounts nw config help

[cirks]

Hope someone can give a bit of guidance.
My sister is director of a CIC and therefore like I'm sure many small businesses don't have the finances available for a full IT support contract so everything is a bit piecemeal. Things I believe have generally worked with their current mix of personal and business owned laptops, local accounts and various file sharing options.

However, with lockdown and them providing alternative education and remote learning plus the kids and young adults needing opportunity to have access to software on laptops (that a grant for the CIC is covering), they need to do the following. This isn't my area of expertise so (although am an IT person but in BI & DW stuff) but I'm looking to set things up for my sister.

9-10 laptops running Win10 Pro
Need central level of control - remote access & prob unattended access
Locked down to an extent to prevent unauthorised s/w
website filtering
email
access to some of businesses shared file resources (poss a NAS in their office)

Key thing I'll struggle with is knowing best way to control the machines with the restricted user accounts. So, do I use group policies (and if so, what's best way to set up)_, do I need a domain controller and add accounts to the domain and control a certain amount that way? Or should local accounts configured a particular way be satisfactory?
Remote access etc should be fine if I use Zoho type s/w but it's the actual config/tailoring of the user accounts I need to sort first

Any help would be appreciated

[Australiam]

I believe there are a few more variables to consider first, to understand exactly what they want to use the devices for, and what controls are required. I've sent you a PM.

[jpringle819]

Office 365 and InTune will do everything apart from web filtering, for that have a look at Cisco Umbrella

[cirks]

Hi both and particuarly Australiam for the pm which I'll respond to in a mo.

As for Office 365, it's not so much the applications I'm looking at (other than Garageband equivalent), it's more the account management and s/w deployment & or control - particularly the restrictions which need to be applied to the machines. We won't go for Office (sorry Microsoft 365) due to costs - it's close to £10pm per user for business use (local installs rather than cloud) so an extra £1K which the CIC can't afford. We'll use something like Softmaker Freeoffice.
I can look at Cisco Umbrella but they don't list pricing on the site - a quick check implies it's around £3pu pm?