Downloading - no! That would be more of a Firewall / ISA
type situation. Installing what was downloaded - yes.
What is it that you are trying to prevent exactly? Take a
look at making users a member of the local
computers "Power Users" or simply "Users" group. You
could use Restricted Users GPO for this...