Lowest practical user account permissions not family and not others.  

1909 build Pro with delayed updates that I will have to succumb to eventually I suppose ... currently up-to-date.
Single user machine (me) at normal admin level.
Wishing to create a new user account for my own use that has the lowest level of permissions that retains reasonable functionality.
Should I just run with the standard lowest settings or is there a more 'polished' way?

Planning to take this machine into a public environment where there may be "inquisitive" rather than malicious people that nevertheless could have a good knowledge of Windows messing.
Planning to use some form of usb "machine lock" if I am logged into my admin account but in all other uses wish to have the most basic account to give a modest level of protection in case my gaze is averted/distracted.
Already have admin/bios password enabled and will be applying bios settings to require this password for all boot methods (usb Linux for example).
May also have a VeraCrypt external drive with usb key (usb hardware number matched to avoid simple pinch and copy).
Must be able to demonstrate that I have taken "reasonable" steps to protect any private data on machine.
Would prefer to avoid Bitlocker if possible but not ruling out any method.

- - - Updated - - -

Following this thread ...
How to remove Guest account?

And then reading this .....
You can't enable the Guest account in Windows 10. Here's why and how others are lying | Digital Citizen

After creating a standard local account ..... as that was the only other option available .....
But now I seem to have a guest account available ... see attached image.
Clicking that just takes me back to lock screen for my own admin account.
The greyed out account is the one created as local standard account while viewing from my own sole user admin account.

So ... no policy or other tricks to get an old style guest account ?

Thanks and apologies for late reply "Samurai" and "RolandJS" ..... typed out reply but methinks the gremlins were out to play last night.
Had a look at Deep Frieze and it is both more and less than I seek (only effective as a refresh/reboot really and does nothing to stop messing in the meantime).
And I am not going to have anything GDPR sensitive (policy will probably not allow that).
So really only after low-level practical anti-messing.
Suggestions appreciated ... but I am still none-the-wiser as to the original/old type of guest account. This seemed like a good place to start ... namely make an "open" machine of least usefullness and least access (as worse case scenario).
I still also do not understand why my own admin account shows as "guest" in the image posted ... or is that just obfuscation ?
Paul