These are basic device lockdown procedures that are very easy to accomplish. If you want to use just TelnetCE and not the Wavelink Avalanche Enabler then use a combination of Program Exit Password & Key and then set TelnetCE to autolaunch at Startup.
Emulation Parameters -> Program Exit Password
Emulation Parameters -> Program Exit Key
Alternatively, If you're using the Avalanche Enabler for lockdown (recommended ) then just set the Enabler to Locked mode. This will allow the user to exit the TE application but will then restrict them from accessing other parts of the device.
Even if you're not using the Avalanche Enabler, you can use Motorola AppCenter to accomplish a similar form of device lockdown.
It was right under my nose! Thank you very much, I'll set up a config file and mark this as resolved.