I don’t know by what mechanism, so it may only be possible with an enterprise license or through device management. But I know it’s possible because I’m on the email thread where someone sought guidance from management and the directive was affirmed to block it on Macs in our fleet.