I can't add a comment so ... what is the OP actually trying to do, stop a user from accessing clients with remote capabilities? Turn off all internet access? Are you realy wanting to prevent incoming access to ports used for remote access [sudo ufw enable
does that as the default is to drop all incoming requests]??
Removing the execute and/or read bits on the client binaries for, eg, ssh
will prevent a user from accessing it [sudo chmod o-rwx /usr/bin/ssh
will stop anyone but owner (root) and group (root) using it assuming they don't have permission to use it via sudo] - however they could just install a new client if you leave them with install rights.
Is this a multi-user machine. If it's serial multiple users (rather than parallel) then you could have a firewall script run on login for non-priveleged users and disable various traffic. But then your user can tunnel traffic over non-traditional ports.
You can bypass any of these by loading a separate OS from a pendrive or DVD and then enable access to the computer. Which brings us back to the ultimate question of "what are you actually trying to achieve?".