You can lock down the Start screen through group policy.
Great if all your machines are in the Domain, a bit more challenging if you also have to support VMs that come and go; then again, they're not the real problem with users customizing, so maybe it's okay.