You can't without taking away every method they could use to install new software. Ubuntu can't whitelist every 3rd party package that a user might want to install.