Or any other better way to prevent end-users tapping it and trying to log in with their own user credentials, only to leave the device in a state where the core functionality/main menu is not available any more?
I've not seen any configuration that allows you to remove settings button. I guess that your SRS systems are joined to Active Directory, so you could use an GPO to limit who is allowed to sign in to Windows.
