Can blocking happen through group policies at the Domain level(s)? At the very least you could prevent the app from running by name. That'd at least stop the punters, but not necessarily the determined folks.

-Zeke