I created 2 scripts, distributed via policy to a smart group for everything that isn't a MacBook. It's worked perfectly for all our Macs, which range from 10.11-10.14. And if you want to re-enable wifi you can just change off to on.
networksetup -setairportpower Wi-Fi Off
networksetup -setnetworkserviceenabled Wi-Fi Off

Thanks, but that's not the same.

That is turning wifi on/off... I really need to set the service inactive.

The commands you gave me allow non-admin users to enable the wifi settings. I need to have them restricted.

But I do appreciate the efforts!

@MagicMick I use the same commands in a script triggered by a LaunchDeamon as @clearyma and it makes the Wifi Inactive. The first command turns the wireless off and if you stop there users can just turn the wireless back on if desired.
The second command of -setnetworkserviceenabled makes the wifi card inactive. From my experience that does not always show in menu bar GUI right away, but it does show in the network pref pane, also if a user tries to turn the wireless back on it won't work and then the wireless icon will change to the disabled icon.

Glad I found this thread.  The two lines of script provided by @clearyma work perfectly on my machines for first turning off then disabling Wi-Fi.  I'm deploying them in a scrtipt payload via policy to desktop machines that we want to keep on ethernet.  This keeps end users from connecting their desktops to our guest WiFi and losing access to on-site resources.