We do support Windows Surface devices as well.
To restrict the users’ access to specific web sites, you can lock down the device into Kiosk mode. You can lock down the device to a single or multi-app kiosk with UWP and Desktop apps. The apps should be installed on the device.
On locking down the device to a single app kiosk, you can run the app in full screen inside a restricted local user account. Click here to know more about the single app kiosk.
In multi-app kiosk mode, you can restrict the device into a handful of whitelisted apps. Before the policy is associated with the device, a local user account should be created on the device and the UWP apps should be installed. Click here to know more about the multi-app kiosk.