If the second drive was in a removeable drive bay, you could take it out when you're not using it, and lock it up. Virtualisation would let you allow untrusted users admin access to a VM, but it wont be as convenient. Or you could ditch the second HD install entirely, and do clean up / remote control from a (read-only) BartPE cd or similar.