Yeah, executing from memory is probably the best way to go. To be frank your question is complex, and you'll need to be able to figure a lot of it out on your own to have a hope of implementing a decently secure solution.

Of course, depending on the skill level of your users, you might have a large enough fraction who wouldn't be able to get past the easy "launcher writes exe and runs it; deletes after running" method.