What's the terminal equivalent of Windows' netsh wlan add filter?
If it's running High Sierra you can turn off auto-join in the system preferences > network > airport panel.

EDIT: question was unclear.  Here's another answer that might be better for the question-asker.

You can create a 'Profile' to install on the system.


Buy Server.app on the App Store.
Learn about Profiles and how they work.
Create a profile with a restirction that prevents the user from accessing the 'network' control panel.
Make sure the WiFi network(s) it's OK to connect to are already set up - the credentials will be stored in the System keychain, so all users will be able to access them.  If the administrator has connected to networks that other users shouldn't - you'll need to 'forget' those networks or move them from the system keychain to a user one.
Install the profile in the users' account, and make sure to disable the WiFi menu while you're at it, so the only way to change networks - other than the command-line if they figure out how - is through the Network control panel, which is now disabled.