In times past, I was happy to let students update their OS as they saw fit, since it was generally a highly reliable operation and a safe thing to do. No more.
iOS does not provide a way for administrators to block users from updating their operating system. It's never needed it until now. Today, though, I regard it as a critically missing piece of a large-scale iOS deployment.
It does seem genuinely confounding that there isn't an update block available for a device that Apple wants to be used in managed enterprise environments.