Couple ways. Put on a policy or make them mandatory profiles.
If you do a mandatory profile, they can change things, but it will be back to original when to log out and in again.
With a policy, I'm not 100% sure what step to take to do it. But that is likely the way you want to go. You can basically just turn off the whole settings area.