It depends on the level of security you want to realize. A simple but viable solution is to deinstall all network systems. This will prevent newbies to do networking by accident/neglect and it will prevent those with malicious intent to destroy/spy the RasPi from a remote side. If such people have physical access to the RasPi there is no way to prevent them to do bad things.
On Raspbian are three network systems available: default used
dhcpcd, optional usable old style Debian
networking managed with the file
ifupdown and the disabled
systemd-networkd. You can deinstall
ifupdown but not
systemd-networkd because it is integral part of
systemd, a core software component. But a user without networking skills shouldn't be able to simply enable and configure
To deinstall network components as far as possible you can just do:
rpi ~$ sudo apt --autoremove purge openresolv
rpi ~$ sudo apt --autoremove purge ifupdown
rpi ~$ sudo apt --autoremove purge dhcpcd5
rpi ~$ sudo apt --autoremove purge isc-dhcp-client isc-dhcp-common
Now there is no way to connect to the RasPi by network and it is also not possible to reinstall these components from the remote repository. The only way to get it back is to configure
systemd-networkd and reinstall the components.