There's a lot you can do with Session-Based Permission Sets. Basically, you can create a login flow that assigns permissions to a specific session. Basically, your basic profile would include only permissions they normally have, then you'd add extra permissions (via the Session-Based Permission Set) to allow them to do other stuff. In your case, it sounds like you'd restrict their basic profile for mobile, then on a web login, you'd add in extra permissions for editing the calendar, etc. I don't believe it's possible to have record-level granularity here, though, but it should get you most of the way. You can read more about this in the Salesforce Security Guide. You might also want to look at this trailhead module.