This is normally controlled by adding/removing users from different groups.
So remove the guest user from the netdev group.
On Debian, the "netdev" group gains access to using Network Manager. On Ubuntu, Network Manager access rights are gained by being at the system console, so the name of this entry in gnome-system-tools is misleading.
The "netdev" group can administer wicd and wpasupplicant.
The "netdev" group can set the avahi host name using DBus.
The "netdev" group can administer Bluetooth devices.