What is your storage being used. There is normally an option with the storage management to mount lun's as read-only which would do it for you.
I have also taken system and any other accounts off of dmadmin.exe and added in a local admin account to the permissions.
This way only this local admin account can go in to disk admin... I tried GPO but there was a way around it each time.