Unless your root, you need to know the password for the account you're su'ing to. If I know the account's password, I don't need to su, I can simply login to the account as a normal user. Can you change passwords so that the user does not have access to any accounts that are not his/hers?

Simply denying access to su will only stop a user from switching user accounts. It will not stop the user performing an interactive login into the specified account, which has the same end result.