You could take an alternative approach, still using your wrappers but first ask

• Do most users of web-hosting need access to lynx, curl, etc?

If you answer no to that for your service then create a new group called WebTools or something and chown root.WebTools the files. Then chmod o-x them.

If they want to use them they should ask for it and provide a reason. Same with compilers and other utilities...

Just a thought...