There is a setting that can restrict a user from creating access groups (I have not bothered to identify it), but there isn't one to keep users from adding individuals to existing access groups. Please restrict all users from being able to add their contacts to any access group.
