I haven't looked at Mountain Lion yet, but I'd imagine something similar to how folks blocked Lion installation would work, i.e, use a Restricted Software item that looks for and shuts down any process called "Install Mac OS X" Unless Apple is using some other process that is not like what they did with Lion, that should do it for you.
Edit: In thinking about your post again, I just wanted to mention that users being 'mobile' or 'remote' does not necessarily mean they have to have full admin rights. There are ways of giving standard users the ability to do many admin level functions, such as adding printers, installing some software, making changes to certain System preferences they would otherwise be blocked from and more. But still limiting them from being full blown admins.
You can also put Software Update into Self Service if you're using that, although if these people don't have a way to connect to your JSS when offsite, that may be problematic.
