As a one off for one person I locked down the permissions (manually) of
the "Install OS X Mojave...app". Mind you, this was for a single user
who wanted the install to stop automatically launching. Obviously,
that's not a solution for multiples, but ...
I am a Network Administrator supporting the Ithaca City School District.