You can use group police to create a Software restriction Zone rule which will make it impossible to install any software from the Internet ZOne. This means you can still allow users to download approved programs from an intranet site, but anything on the internet will be blocked. Another option is to set the software restriction rule based on file type. This way you could block *.exe files.