Possible to disable THE postgres role?
You can specify the name of the database superuser at the time of running initdb.
It will default to the name of the user running the initdb command itself, but specifying --username or -U will change that.
https://www.postgresql.org/docs/9.6/app-initdb.html
Let me highly suggest that you don't even for a second consider trying to take away any privileges from the database superuser role, regardless of its name.
Many privilege checks within the database are coded in such a way that the superuser is always allowed to continue, no questions asked. It is, after all, the superuser role.
I can only assume that your auditors are either clueless or were referring to some use of the postgres role by applications or by developers. In the latter cases, it is definitely advisable to restrict access and create appropriate roles/users within the database for these tasks.
This is my recommendation: make sure that user postgres cannot login from anywhere (besides locally via unix sockets and localhost, and possibly via network for streaming replicas) via pg_hba (and use at least peer and md5 authentication).
Changing the superuser's name does in no way increase security.