Maybe you can fool your users inserting in their environment these custom functions:

builtin() { echo "builtin is disabled"; }
unset() { echo "unset is disabled"; }
pwd() { echo "pwd is disabled"; }

For now I don't have any clever ideas