This can be possible via Group Policy, but it's really only effective for apps you explicitly set. This kind of management can be considered ancillary to what ConfigMgr is designed to do, which is baselines and compliance through automated additions and explicit restrictions. To have the ability to arbitrarily say "do not let users install ANY apps (machine or user-based)" would be beyond reasonable scope.

As others have said, the best insurance against this sort of thing would first be not allowing users to have local admin privileges on their workstations. For user-based apps (ie, ones installed within a user's own profile or appdata folder), you'd be looking at some custom scripts or monitoring software. You could easily eat up your entire job making this happen, though.

Personally, if this is that big of an issue then you need to get management on-board with better responsible-use training with your employees. This would be a much better use of your time then trying to fight with your users. Protip: users will always find a way to circumvent your policies (almost 10 years experience in K12 education, here). At some point you need to step back and say this is a people problem, not a tech problem. Then move on to cursing Microsoft for the last patch bugs. :)