Block any commands for players with a simple list. Namespaced forms like /bukkit:plugins are blocked too, OPs can bypass.