You can use the
readonly Bash built-in to make a variable, well, read only. But this is unlikely to deter someone bent on changing their environment, as they could simply start a new shell without running the RC files and set up their own environment. Also, this does not in any way hinder someone from running programs not in the
PATH variable is simply a convenience feature, to allow users to write
foo rather than for example
/usr/bin/foo. That's it. It's not related to security in any way.
The key to securing an environment is to first take a long hard look at what your threat model is - do you expect users to try to read other users' files, to break the installation, to eavesdrop on communications, to send spam, to get root access, or something else? Once you've established this you can start working out which measures will actually achieve this.