So this isn't exactly what you're asking for you but I'll tell you how I deal with the issue in my house.
I have a server that's set to the family-friendly user so anyone who uses a remote connected to the server can only see the family friendly stuff.
But as you noted, full PC clients can change users so they can see everything. If you log your remote into one of the PC clients set to the "everything user" the remote will also be able to see everything on the server. So I keep the client MC instance on my own personal computer set to the "everything" user, and when I want to see "everything" on the server I just log into that client with the remote. I also make sure any "public" devices (or child accessible devices) don't have the access key for my personal computer, etc.
It's not perfect, but it works for me.