This is governed by several things. Generally the default is not to be able to do this. If your users can do this, then it is because your database and users have been set up to allow it.
OS Authentication only works when you have an OS user name compatible with a database account name that has been set up as IDENTIFIED EXTERNALLY
By compatible, I mean it has the appropriate OS Authentication prefix.
By default an OS user 'fred' would connect to a database account 'OP$fred'. If such an account doesn't exist, he can't connect. If the account exists but wasn't set with IDENTIFIED EXTERNALLY he can't connect.
It is worth noting that, for some situations, it is a secure mechanism. For example, if you set up cron jobs under OS user 'batch', then you can have a database account for that user which can only be connected to by that OS account. The general alternative to that is having a username/password stored in a config file. Inevitably that file gets read by someone who shouldn't read it, backed up to an insecure location....
Assuming you do want to block them, simply do an ALTER USER batch ACCOUNT LOCK or ALTER USER batch IDENTIFIED BY password;
Note: There is a separate issue about users in the dba group being able to connect with the '/ AS SYSDBA' clause. The simple answer to that is to remove such users from the dba group. If they have sudo/root access, just ask them nicely not to do it. If that doesn't work, you can try AUDIT to track what they do, and get your manager involved.