To prevent users from booting to single user mode and recovery mode is by enabling and setting a firmware password. Secure boot should already be enabled by default to prevent booting from external devices.

For intel Macs you can put an EFI password on the device which will lock recovery behind a password. This wont work on Apple Silicon Macs, and the function that locks that out on Apple Silicon is broke in JAMF right now.

https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Setting_or_Removing_an_EFI_Password.html

Thanks for the info there AJPinto. I wasn't aware of that. My org doesn't have any M1 macs yet. 

Hello,

Apple Recovery mode is a default set of tools in your macOS created to offer you safe Mac boot options to recover your Mac from software issues. First introduced in 2011 with the release of Mac OS X Lion, the ability to boot Mac in Recovery mode greatly simplified macOS reinstallation while giving users more control. 

MacBook Recovery mode also makes using your Mac more secure. For example, if your Mac has a T2 security chip and you want to use macOS from an external drive, then your only option is to boot into Recovery Mac mode.

@AJPinto Recovery lock password for M1 Macs works perfectly now on the latest release 10.33, check it out