[silverwind]

This seems to be the best way to prevent it from even installing on MacOS, e.g. works with SIP as well.