You can do that with
Hooks, but to be honest, this seems like not a good solution against anything but the most naive meddling.
Which is fine, though, maybe you want to prevent a child or a pet to trigger a command, so, yeah.
There is also 'accept-line' that you could override, but that can mess things up quite a bit since it tampers with one of the more fundamental bits of zsh.
Anyway, don't use this as a serious security measure. Checking aliases and the shell rc files are easy and obvious targets for inspection and there are most likely tricks to get around the hooks, too.
(I honestly don't know them, or I'd tell you them.)