It all depends on the person; but a good first step would be to change their default browser to Chrome or Firefox - install AdBlock Plus (http://adblockplus.org/, or similar) and Ghostery (http://www.ghostery.com/) in their browser, and a decent anti-virus (Microsoft Security Essentials (http://www.microsoft.com/mse) should be fine, and since it's free - you don't risk them just not renewing). Install Soluto (https://www.soluto.com/home) and keep an eye on any changes to default browser, etc.
Turn on auto-updating for everything, Windows, your browser, Flash, Java, etc.
Make sure UAC is on, if they like to just click through the prompts, make them non-admin and set up an admin password - that way they have to enter it to do anything and you should print that on a bit of paper under the words "THIS MAY NOT BE A GOOD IDEA".
Now, a slightly controversial one, disabling Internet Explorer: on their machine, go Start/Run and enter 'gpedit.msc', navigate to Computer Configuration / Windows Settings / Security Settings / Software Restriction Policies / right click that and choose 'New Software Restriction Policy' and then under additional rules, right click, New Path Rule and enter 'c:\Program Files\Internet Explorer\iexplore.exe', make sure it's set to Disallowed.
Going extreme (with a key, etc.) is going to be a hassle - you want the experience to be something familiar. The Group Policy edit is to prevent them bypassing Adblock or Ghostery unwittingly.
That should make it largely worry-free. Soluto should give you the ability to remotely install TeamViewer or whatever and remote in if something goes wrong, but that should cover most malware entry points.