How to disable Boot Camp and prevent any other OS installations?
If you do not want an user installing operating systems, then you would create a standard account for the user. In this case, the Boot Camp Assistant application can not be used to install Windows without first entering an administrator username and password. This is shown below for Big Sur.

The rest of this answer assumes the following. See About Secure Boot for more information.

Firmware password protection is on.
Secure Boot is set to Full Security.
External Boot is set to Disallow booting from external media.

The firmware password is not required in the following cases:

Selecting Restart in macOS… from the menu produced by clicking of the Boot Camp icon  in the notification area on the right side of the Windows taskbar.
Selecting macOS from the Boot Camp Control Panel in Widows.
Selecting your Boot Camp volume in Startup Disk preferences of the macOS System Preferences application. However, this does require the password of an administrator.

The firmware password is required in the following cases:

Before using the Mac Startup Manager to choose the Windows (Boot Camp) volume.

Before using Mac Startup Manager to choose any macOS volume.



In other words, the firmware password is require only if the selection of a operating system is done using the firmware. The Mac Startup Manager is implemented in the firmware.

If one were to set the firmware password, the user would not necessarily be prompted for the password every time when trying to boot into Windows. The password is only asked for, when the Mac Startup Manager is involved.
If someone installed Windows via the Boot Camp Assistant, they would not be asked for the firmware password when trying to boot into Windows for the first time. They would not be asked after the first time either. Windows actually restarts (reboots) several times during installation.