You can't. If you want to allow someone to do anything as root, they don't need su or sudo to become root. Simply allowing them to run chown and chmod as root will give them root access to the server. Heck.. just allowing them to edit the passwd file as root will give them root access... and this could be with cat, echo, sed, awk, vi, vipw, etc, etc.
This is one of the silliest uses of sudo that we see in the security space... allow someone to run anything as root, but don't let them become root. Duh... it doesn't work that way.
Being root by name isn't special... executing as UID 0 is what matters. All someone would need to do is chmod SUID root /bin/bash and they'd be root. Or simply change their UID in /etc/passwd to 0 and they are root as soon as they login. Two easy examples, but there are many more.
Root access should only be granted to those responsible for the system... and at that point, sudo is a joke... just let them su to root. For non-sysadmin users that need limited root capability, then sudo makes sense, but only if you allow very specific command execution and only if you know enough about how the UNIX OS works that you don't give out root access to risky executables... ie vi, chown, chmod, cp, mv, etc, etc. and that you limit the arguments and execution modes of those commands.