How do you completely and securely disable sharing between guest and host?

I'm implementing a rollout with Fusion 4 where I need to prevent file sharing between my Windows 7 enterprise guest and OSX Lion hosts on MacBook pro laptops.

The goal is to have no ability at all to drag and drop files between the two enviroments.

I know I can simply not install the windows toolkit, but that locks me out of drivers I need or I can simply go in Fusion and disable sharing, but then the user can simply flip the switch and they are back in business :-)

I'm wondering what I'm missing??

What driver in the Windows toolkit enables sharing/dragging file between the environments?

Is there a better approach I can take way to disable sharing (edit a kernel and/or .VMX)?

All help welcome