Two things I can think of straight away but will
require you to do some work.

Use software restriction GPO. It will ensure on
corporate approved applications are the only ones that
can execute so even if installed by the user they
cannot launch it. It doesn't solve the problem but
makes sure even i...

[ more ]