Configuring a simple system (just LXQt, Firefox, Libreoffice) and adding software as needed is a proven approach for that age group. Regarding “web filtering”: Using a 4th Gen i3 machine magically solves this. (Kids will just use their smartphone to circumvent any controls.)
I second just giving them a browser, and hand-holding them through getting some steam games to work with proton. If libreoffice is as unusable as it has been in my experience, show them Google drive. They may eventually take an interest in playing with adobe software because their favorite internet people do, show them obs/gimp and maybe find some cool video editing software to suggest.
Setting up flatpak with an actual flatpak-supporting gui package manager will give them the tools to figure out installing software without having to learn to program, too.
Challenge them to learn, don’t let them get too frustrated though, and make sure the games they want to play end up working (at least as well as the hardware allows), otherwise they’ll just want a Windows machine.
Speaking from experience, given a sufficiently motivated teenager (which by placing restrictions you will have), even if they don’t just escape your controls through alternative channels, at best you’re giving them some black hat experience.
I’d suggest doing that at the router level, though even that’s not going to be enough most of the time, because proxies and VPNs exist and even if you manage to block out all of that your neighbors will have wifi networks with weak security.