One hacky way to disable the package manager is to deploy a customised DynamoPackage.dll.config file to all users, without a packageManagerAddress value. Once its removed, it will no longer be able to find the server…and so no user will be able to download anything:
You can find this file in C:\Program Files\Dynamo\Dynamo Core\1.2