I needed to do something similar for staff members who wanted "loaner/checkout" iPads. Grain of salt—I did make a proof of concept but at some point the demand died down and it was never put in to practice (and the proof of concept wasn't very secure.)
We didn't know who would be in charge of maintaining the inventory (or if anyone would be at all), so I came up with the same carrot-and-stick idea to hide all of the apps if the device had gone more than a week without someone updating who was the current user. The full process is fairly straight-forward, and requires an extension attribute, a smart group, the API and a web page that can run a script to make changes on device records.
I added a mobile device extension attribute for "Last Checkout Date". I made a static group for the intended "Checkout Devices", and then a smart group called "Checkout Expired" with the criteria of Group Membership is "Checkout Devices" AND Last Checkout Date is over 7 days ago. The "Checkout Expired" smart group had a configuration profile that hid all of the apps, and added a webclip for our checkout form.
That webclip's URL had a variable for the device's serial number (like this: http://your.server/checkout_device.php?ipadSerial=$SERIALNUMBER) so it could be passed to some PHP functions facilitating all of the API work. Every week, the device's apps would be hidden because of changing smart group membership and the user needed to pop in their username into the form (like I said, proof of concept). The script would then update the user and "Last Checkout Date", which would then take the device out of the "Checkout expired" group, releasing the hidden apps, etc.
You could do something similar with a user extension attribute, and instead pass a $USERNAME variable in your webclip to your form page.
