Stop running programs from network drives?

[IAmATeaf]

Is there an easy way to stop users from running apps from a network drive? We have desktops which are locked down but users are installing apps to their personal network drive and running them from there.

I've had a look at GPO that's based upon a white list, what I'm after is a way of simply saying they can't run from C:\TEMP or H:\

 

[IAmATeaf]

Well I've sort of found a way, put deny permissions on Traverse Folder/Execute File at the top level folder but am wondering if there's a more elegant way.