Here’s an initial upstreaming of the parental controls implementation from Endless OS, for discussion. I’m sure quite a lot of it will need to change before it’s suitable to actually be merged.
The general principle is that it queries the parental controls policy from libmalcontent (which loads it over D-Bus from accounts-service), and it uses that to filter which launchers are shown. The idea is that the parental controls policy can blacklist launchers.