As was alluded to... you can prevent desktop manager use all together, or just the loader app. If you disable DM use, this would require wireless enterprise activation whenever an OS upgrade was done. As the BES admin, you can choose to deny an activation unless you approve of their OS level. You as the admin must set an activation password and communicate that password to the end user. No password = no BES activation.
Treat your password like your toothbrush. Don't let anybody else use it, and get a new one every six months.