dconf has options for lockdown and also has an example (where they use the wallpaper ;)) on the dconf system admin page:
Lockdown is supported by creating a 'locks' subdirectory in the keyfile directory (ie: /etc/dconf/db/local.d/locks). The files contained in this directory contain a list of keys to lock, one per line. Just as with the keyfiles, you may add any number of files to this directory. Here's an example of what one might look like:
# prevent changes to the company wallpaper
Of course, you need to run the 'dconf update' tool after changing the locks. The tool will notice if the timestamp on the 'locks' directory has changed, so there is no need to touch the ".d" directory as well.
Presently (as of dconf 0.7.4) lockdown is only supported on a per-key basis. Put another way: you may not yet lock entire subpaths. This is for performance reasons, but there are plans to address this in future releases.