You can use Polkit rules to control the GUI shutdown privileges (the
shutdown command isn't affected, and needs root as usual). A set of rules like in this answer should do. Create a
.pkla file in
[Disable Shutdown, etc. for all users]
auth_admin policy will require that an administrative user (by default, members of the
sudo group) authorize it.