Via local group policy:
Block users from installing or running programs in Windows 10/8/7
Type gpedit.msc in start search and hit Enter to open the Group Policy
Editor. Navigate to Computer Configurations > Administrative Templates
Windows Components > Windows Installer. In RHS pane double-click on Disable Windows Installer. Configure the option as required.
This setting can prevent users from installing software on their systems or permit users to install only those programs offered by a
system administrator. If you enable this setting, you can use the
options in the Disable Windows Installer box to establish an
The “Never” option indicates Windows Installer is fully enabled. Users
can install and upgrade software. This is the default behavior for
Windows Installer on Windows 2000 Professional, Windows XP
Professional, and Windows Vista when the policy is not configured.
The “For non-managed apps only” option permits users to install only
those programs that a system administrator assigns (offers on the
desktop) or publishes (adds them to Add or Remove Programs). This is
the default behavior of Windows Installer on Windows Server 2003
family when the policy is not configured.
The “Always” option indicates that Windows Installer is disabled.
Edit: this blocks programs installed via the Windows Installer. I am unaware of a way to block software installation outside of locking down the Windows Installer.