Disclaimer: I don't have a lot of time at the moment and I'm french speaking... Sorry for the rushed "how-to", I'll clean it and add details up when I'll have more time. Feel free to add your 2 cents!
1. You need a device running Android 4.2 (no root needed).
2. Create a new user as usual (follow the Android tutorial).
2.5. Verify everything is ok for this account.
3. Once done, go into this new user settings (don't switch to your main/admin account).
4. Add a new account, this time use the Google account on which you paid for your apps.
5. During the add account tutorial, make sure you unselect ALL syncing stuff. <=== VERY IMPORTANT!
6. Once done go into settings -> applications and deactivate all the apps you don't want the new user to access (ex: gmail, g+, calendar, etc...).
7. Launch the Google Play Store and select your main account, make sure you protect application purchase by a PIN.
8. Installed a paid apps under this account.
9. Enjoy!
WARNING 1: I had an issue with Google+ when I deactivated it, it removed the updated version (so when I switched back to my main account, I needed to update the app through Play Store). May happen to other apps.
WARNING 2: I don't know if it's related or not, but in the process, I needed to reboot my Nexus 7, it was slow and unresponsive (a process or app was sucking a lot of CPU cycle). But, it did not happened again.
TIP: Use email app instead of gmail to sync the other user mails.
CAVEAT: Experienced users or clever children may find how to reactivate the apps you locked, so you may want tu use an app locker instead of the "deactivate method".
It's not perfect and it works, it's enough for me. My daughters will enjoy their games and I know they do not mess with the system. Tested on my Nexus 7 but I'm pretty sure it will work on all Android 4.2 devices.
1. You need a device running Android 4.2 (no root needed).
2. Create a new user as usual (follow the Android tutorial).
2.5. Verify everything is ok for this account.
3. Once done, go into this new user settings (don't switch to your main/admin account).
4. Add a new account, this time use the Google account on which you paid for your apps.
5. During the add account tutorial, make sure you unselect ALL syncing stuff. <=== VERY IMPORTANT!
6. Once done go into settings -> applications and deactivate all the apps you don't want the new user to access (ex: gmail, g+, calendar, etc...).
7. Launch the Google Play Store and select your main account, make sure you protect application purchase by a PIN.
8. Installed a paid apps under this account.
9. Enjoy!
WARNING 1: I had an issue with Google+ when I deactivated it, it removed the updated version (so when I switched back to my main account, I needed to update the app through Play Store). May happen to other apps.
WARNING 2: I don't know if it's related or not, but in the process, I needed to reboot my Nexus 7, it was slow and unresponsive (a process or app was sucking a lot of CPU cycle). But, it did not happened again.
TIP: Use email app instead of gmail to sync the other user mails.
CAVEAT: Experienced users or clever children may find how to reactivate the apps you locked, so you may want tu use an app locker instead of the "deactivate method".
It's not perfect and it works, it's enough for me. My daughters will enjoy their games and I know they do not mess with the system. Tested on my Nexus 7 but I'm pretty sure it will work on all Android 4.2 devices.