How to deny the user the ability to upgrade the latest iOS version on iPad?
In a word, no.

It is not possible, either with Apple Configurator, or other MDM solutions, to restrict users from updating iOS when new versions are released.

Being able to update iOS without simultaneously being able to update apps (as can be set up using supervised iDevices in Apple Configurator) can lead to big problems, such as incompatible apps and lost data.