Disable user's ability to change FileVault recovery key
Remove the user from the admin group would be the simplest method. The fdesetup needs sudo permissions or someone to re-enable the root user. Both of those options are possible when you have admin credentials.