Japp! Porteus Kiosk is a great fit for exactly that kind of locked-down, read-only setup. Solid choice for replacing those XP boxes.
And you nailed the real pain point: VNC just doesn't scale past a handful of machines.
Once you're managing dozens, you need management functions that run centrally from the CMS, reboot, update, status, not logging into each device one by one. That's where remote-desktop tools make things complicated.