I've heard nothing but good things about Windows Server 2008 R2 SP1, and SP1 for Windows 7 won't do much. (See this article for more about what SP1 brings to the OSs.) But if you've got an environment that's big or complex, or you're just a little paranoid, you might not want your users installing SP1 without your supervision.
Microsoft's Windows Service Pack Blocker Tool Kit is available. The kit has a script, an executable, and a template for Group Policy, so however you want to block, it's got what you want.
Speaking of service packs, don't forget that your XP machines should be on SP3 now. Support for SP2 ended in July. (See the Microsoft Support Lifecycle page for XP here.)