NOEXEC tag doesn't prevent programs from getting executed. It prevents listed programs from executing any other programs. From man sudoers:
aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
This allows user aaron to run /usr/bin/more and /usr/bin/vi with noexec enabled.
This will prevent those two commands from executing other commands (such as a shell).
If you are unsure whether or not your system is capable of supporting noexec you can
always just try it out and check whether shell escapes work when noexec is enabled.
If you want to prevent users from executing a specific command have a look at
ssh ALL=(root) ALL, !/usr/bin/passwd
Please note that this line does not help much as it would be possible to create a copy of
/usr/bin/passwd under a different name, copy one onto the host and set the appropriate permissions etc.