User accounts are not allowed to use the sudo
command, meaning there is no way for them to access any root privileges, meaning no package installations or filesystem tampering, etc.
To block a user from using a program, a simple way is to create a whitelist for that program. To do this, use the following commands in the terminal:
sudo addgroup GROUP
sudo chmod 750 /usr/bin/PROGRAM
sudo chown root:GROUP /usr/bin/PROGRAM
adduser alice GROUP
adduser bob GROUP
Where GROUP is the name you want for the whitelist for the program, PROGRAM is the name of the program, and "alice" and "bob" are replaced with the actual users on your system you want to allow access. Any users not in the group will be denied access.