Preventing the install of software is easy. The operation can only be performed by an administrative user with sudo capability. Control who has access to this capacity and perform any updates or installs remotely via SSH or remote desktop.
Bear in mind, that as the old saying goes, physical access equals root access. If you really want to prevent this from happening you will need to physically lock the machine down too: eliminate recovery boot, prevent bios changes, lock the case, etc.