Thanks for the replies.
It's not that I want them on the old OS, I just want to prevent them from loading an OS that I do not approve of/not supported by the carrier, that is know to be buggy. Also, there is no reason to update the OS if there is nothing wrong with the current one! Unless there are some new features....
I know I can just not give him an activation password...but that is not feasible at the moment. I have to comply.
What we need is a written policy set in place that will underline these points...that way I can enforce it.
I set the application loader to false...we'll see how that goes.