I am pretty sure the answer is "No", but does anybody have a good method for blocking internet recovery and not the Recovery Partition recovery?
Internet recovery seems to want to present Catalina now, and for obvious reasons we do not want our users having an option to move to this OS on their own at this time.
Not that this helps much, as it's not the kind of solution I think you were seeking, but would not an EFI Firmware password prevent booting to other devices including Internet Recovery?
Apple's made things on modern macOS such that it's become simply a choice of which bag of cats you must manage.
I second @Sterritt, a firmware password is the only way to block internet recovery, although it's going to block the standard recovery partition as well.
At some point it becomes a policy/HR issue if your users are going around a directive or request to not upgrade to Catalina. At my org if a user updates and they have issues, we just erase and install back to Mojave.