It would be nice if there was an easy way to prevent people from installing vscode remotes on a shared server... Probably can run an ebpf routine to disallow creation of folders named . vscode*
Disabling ssh alternate channels will make it uncomfortable enough for most people to be a deterrant. But if you require multiple ssh channels for different reasons that won't be a solution for you.