Disallow iOS version updates on iDevice
You can disable OTA updates by installing the Apple TV beta profile on your iOS device. If you are an Apple Developer you can obtain the beta profile from the Downloads section. Installing this profile changes the software update catalog location to the one used for Apple TV updates, and therefore iOS reads the catalog and finds no updates suitable for iOS.

If your device is jailbroken, you can install NO PLS RECOVERY which prevents your device from entering recovery mode initiated by iTunes, preventing iTunes from updating the device.

It's not possible to prevent someone with physical access to the device from entering DFU using the buttons on the device and restoring iOS.