A simple method of the App Store is to just move the application out of the Application's folder and store it on the local admin's Desktop. The managed user will have no access to the app and thus will not be able to use it.
For iTunes, take a look at iTunes > Preferences > Parental. There is an option in there to disable iTunes Store access. Make the change, isolate the preference and push through management console.
How can one "isolate the preference and push thorugh management console" though? I'm unaware of how to manage app sepcific preferences (sorry, brand new OS X admin here).
The file is com.apple.iTunes.plist which is stored on a per user basis. The key is:
This needs to be set to true.
What are you using to image the machines and what are you using to manage then after the fact? If doing monolithic imaging, add this to the English User Template and then all new accounts will inherit. If adding to systems post, you can use MCX (although this is depreciated and your success may vary). If you have Apple Remote Desktop, you could send out to all users to dynamically set it. If you use JAMF you can establish a policy to keep it enforced.