
I'm assuming your talking abou Azure AD Apps (Entra ID)? As far as I am aware, there is no way to prevent a user from attempting to enable an AAD app in your tenant, but if you disable user consent, then this will always require an Admin to consent, who can decline if needed.