A dedicated user can bypass any restrictions, but you can make it difficult.
First, you can disable plug n play for port forwarding and only forward the ports you want through, however however if it was me and i was dedicated to get through, I would just set my file sharing to use port 80 or 443 and this would just totally F you up. You cannot block those ports and it would be even worse hell 4 everyone.
Another way you can go is allow plug n play, look in the log and see what ports they connect with then set up qos on those ports allow them some bandwidth but set it the lowest priority and highest for other traffic, that way when someone uses the internet they get priority and the file sharer will have some some file sharing, but not hog the bandwidth. They will be less motivated to bypass your restrictions. Also enable ipp2p and layer7 for their sharing this is for qos for sharing applications. Some people use this to block p2p but it has some negatives as well effecting regular traffic and p2p has ways of getting around this as well.
The problem with banning access is that if they encrypt their sharing, filtering has little effect.
A user with a little knowledge can set up an encrypted vpn and there is no way to block it or limit it in any way. Once this happens no keyword banning, no filtering and no port blocking will work, no blocking keyword searches either. The traffic is all encrypted, secure and private. As an example of how effective this is, China has the most advanced and effective internet restrictions in the world set up by the government and people use vpns to get around them.
Another fair way to go is to divide up the band width and only allow each user a set amount.
This is a big issue for the big service providers as well.
There is no perfect solution.
Best luck with your network