My setup is a bit extreme, but here are my guardrails:

1. All users have the same UID's on every system. I'm 1000, wife is 1001, son is 1002, daughter is 1003. All these exist on all systems. Our primary group is "family" (gid 10000). Our files are all owned by user:family. This matters because we let them have access to the share of things like home movies and pictures, and I have a TrueNAS with an NFS mount that their user folders rsync to nightly for backup. If you wanna get crazy, you can put in a whole LDAP/freeIPA setup, but that's a lot (and I did all that as a learning experience).
2. They don't have the account passwords. I have their password, and if they want to use it, the wife or I have to type the password. When we want them off, superkey+L to lock the computer, and if they reboot it comes to a login screen.
3. If you really go this route, and go the whole LDAP thing, you can also tie that into apps like Jellyfin. I have a huge library of movies and shows, but there's a folder called "KidMedia" and I literally manually symlink things to that folder if I want them to have access. I set up the phones/tablet with their own jellyfin accounts, and when they log in they only see their media. I also NFS mount that share, so for the same reason, they can watch stuff on VLC from the computer with access control. We also do that with nextcloud, so we can use nextcloud talk to chat internally. The tablets/phones have built in android controls, so the idea is once they're on their device, they're free within the ecosystem I set up and they don't enter credentials other than device unlock.