> Disallowing powershell or scripting altogether makes it impossible to use as well.

You can't really do that, as pwsh can be embedded easily.