There are a couple of ways to do this. One is to use RestrictRun, as detailed here.
You can also deny access to specific programs using NTFS permissions.
To prevent a user or group from running "program.exe":
\program.exe /E /D
You can also create a simple user-level account on each machine that doesn't have permissions for installing software.
This was first published in July 2002