I've added a restricted process for the App Store in the JSS so any user will find they're unable to launch it via /Applications or Spotlight (the process gets killed immediately).
However, I find that they can still launch it via Apple Logo > App Store... or Apple Logo > Software Update...
How can I prevent this? I want my users to use purely Self Service.