Bad idea. Don't go there.
Unless ALL your systems are completely locked down to the point no one is ever going to need to install anything.
Blocking folder/file creation at the root of the systemdrive will break a lot of software, especially installers for device drivers as these often create working folders directly from the root of the drive.
Also Windows 10 InPlace Upgrades (and probably some other Windows updates as well) need to write to the root-folder.
And some system-processes, like Hibernate probably don't like this either
And "DENY Authenticated Users", as some people suggest in other answers, ALSO is a DENY for Administrators. DENY overrules everything. An Administrator can undo it, but that takes manual intervention, which is something WindowsUpdate, etc. can't do.
In a managed software environment (like SCCM) you can cobble something up as a wrapper around every installer, but that is a lot of work.
Or you can use a local (non-domain) admin account for SCCM and limit the folder-access for "Domain Users". But that is also hard to setup and possibly a security-risk. (You would need to setup individual passwords for that account on every computer and store these somewhere for use by SCCM. If you use the same password everywhere if one compromized, every computer is.)
In fact: The company I work for actually does it like that with SCCM and individual local admin accounts on every computer (about 200.000 systems), but we aren't crazy enough to lock-down the root-drive. Too much potential for causing all sorts of weird side-effects/problems.