Supervised users is weak.

"No apps and no extensions" blows.

We can lock the cupboard with the chemicals in them to protect the inexperienced.

A psychology professor friend of mine told me how he instead showed the child what was inside. Actually swabbed some ammonia on a cotton swap and brought it near his cheek to demonstrate first hand the caustic properties. This he said was far wiser than locking the contents out of reach.

This wouldn't work for a two year old. As parents we have to choose a time and an approach.

With your chosen approach the best Chrome OS offers is Supervised users.

There was a suggestion to use your routers blocking features. A proxy service of sorts. Open DNS? Net Nanny?

You need both. Use Supervised users on an account so you have fine tuned web access control. And use a proxy for an account which blocks access to the internet, but allows access needed by the apps you want to be installed. This will be a chore.

There is no right answer, but many wrong answers.

The correct answer is just make it so that your child isn't negatively influenced by all the cat memes they'll see and positively influenced by the "PETA animals are people too" propaganda videos. I mean, come on really? It's just a dancing cat with a lime for a hat on its head for Christ's sake.