In tip 0362, we discussed the use of RestrictRun.

You can also deny access to the program, using NTFS permissions.

To prevent a user or group from running program.exe:

CACLS <Path>\program.exe /E /D <User or Group>