How can I make only *one* user controlled database
You can only really hope to log this and raise alerts.  Users who can administer the hardware can always stop the service and bring a database up in single user mode etc.  They can give themselves elevated permissions etc.

It's a common requirement to segregate administrative duties so that server admins cannot see confidential files or confidential data.

However, because every administrative role can typically elevate their rights or create other users, requiring users to use least privilege accounts for their daily work and auditing what is done with elevated accounts is really the only way to deal with it.