The possibly slightly more elegant (technically) solution is to use the "KeyChain Access" tool in the Utilities folder.
Right Click on the "login" keychain in the left hand column and select the option to "change the keychain password". Once done, right click on the login keychain again and select "Lock Keychain"
What you have effectively done is put the login keychain under a separate password to the user account password which unlocks the login keychain on logon. ie. it won't do that now.
When you visit a network share, if a key exists for that share the user will be asked to unlock the "login" keychain which they won't have the password for. They can then click cancel, click the "Connect As" button and fill in the login details for the share they need.
If a key doesn't already exist for that share, and they do select the checkbox "Add password to keychain" they'll be asked to provide the "login" keychain password before it can be added. Which again they can't do.
If you want the 2nd scenario be sure to delete any existing network share keys from the "login" keychain.
Also note that MacOS X Mail and Safari both use keychains for account access so will interrogate you for the keychain password. If you are using these apps, then i'd suggest creating a 2nd keychain, drag those keys into that one and leave it unlocked. Or share the password for that 2nd keychain. These are just examples, it applies to any tool that uses keychains.
The reason for not putting the network share keys in the 2nd keychain is that they can still add a duplicate key in the login keychain. Default behaviour of that check box is to put a key in the login keychain, i don't believe that can be overridden.
Hope that all makes sense, leave a comment if not and i`ll follow up, perhaps with a screenshot.
M.