no matter what rules you apply to prevent either of your desired options will result in circumvention. sudo bash gives them root access and then they can do what they want. If you want to achieve RBAC with sudo you HAVE to isolate users from root such that they are in a wheel group with explicit commands that may not impact privilege escalation on the system.