take any distribution that someone at or close to the library is comfortable with, e.g popular Ubuntu or Debian,
setup a user profile that fits the need of the average library user, e.g Firefox with as a start page the library website
make sure the library card system do work
copy /home/thatuser directory somewhere, e.g /root/thatuserunmodified and insure permissions make it unmodifiable
add a cron task so that every evening 1h after the library close any thatuser session is terminated, /home/thatuser gets deleted, copy the /root/thatuserunmodified to /home/thatuser and fixer permission
assuming it’s fast enough (I bet it’s take 1min at most as /home/thatuser would be mostly empty) I’d do the process after each logout so that each new visitor gets a fresh session, no downloads from previous users, history, bookmarks, etc. Only what the library consider useful.
That’s it. This way one can still let the OS do it’s updates but the user experience is consistent.