Once you define the sudoers specification with the 'ALL' keyword in the commands field, there is no way to effectively prevent the execution of a specific command or set of commands. The sudoers manual explains this in a straightforward manner:
Limitations of the ‘!’ operator
It is generally not effective to “subtract” commands from ALL using
the ‘!’ operator. A user can trivially circumvent this by copying the
desired command to a different name and then executing that. For
bill ALL = ALL, !SU, !SHELLS
Doesn't really prevent bill from running the commands listed in SU or
SHELLS since he can simply copy those commands to a different name, or
use a shell escape from an editor or other program. Therefore, these
kind of restrictions should be considered advisory at best (and
reinforced by policy).
In general, if a user has sudo ALL there is nothing to prevent them
from creating their own program that gives them a root shell (or
making their own copy of a shell) regardless of any ‘!’ elements in
the user specification.
The only way to avoid the scenario described above is to have a list of allowed commands that the user can execute, i.e. a whitelist.