How to disable Boot Camp and prevent any other OS installations?

Is it possible to completely block the use of Boot Camp such that the current Mac OS installation is the only OS available to use? This is for T2 security chip enabled Macs specifically. I found this page: About Secure Boot I think the option to "Disallow booting from external media" takes care of scenarios where one could boot from a Linux live USB drive. But the "Full Security" option seems to indicate that Windows installed via the Boot Camp Assistant would still be considered secure or signed...? I want to know, if there is an option to block that avenue of installation as well; so effectively disabling Boot Camp. If one were to set a firmware password, would a user be prompted for it every time when trying to boot into Windows? Like how this question may indicate: Booting into Windows partition prompts for firmware password . I am wondering if setting the firmware password is enough? For my specific scenario, the key is to prevent booting into another OS. I am OK if someone tried to install Windows via Boot Camp Assistant, but then became thwarted by the firmware password when trying to boot into Windows for the first time.