you cant really...you can disable registry editing, so that most installs wont finish, and most installs know they are in 2k and say "you must be a member of administrator group to install"
thats about it though...i mean what else does an install do, it runs itself, an executable, which obviously you cant disable running executables, and it copies and makes files, you could set the permissions so that they cant mess w/ winnt/system32 and all that, also program files/, other than that i dont know