Resource limits for users are set (via PAM) in
/etc/security/limits.conf. More fine-grained control can be had by using SELinux (but easy it isn't). The
r shells/commands are a straightjacket, to be used to completely constrain external connections. You could set up
chroot environments, or even custom virtual machines/containers.
But then again, consider carefully what you are doing. It is OK to restrict effects of possible accidents (fork bomb, anyone?), it is quite another to curtail legitimate actions. Users under fascist system administration will get mad, and will find a way to get even. There are usually many more users than sysadmins, by sheer numbers they'll get the upper hand. The good will of your users is precious, don't squander it.