How do I not let certain users run an installed application?

I have a computer lab at a school that is running Snow Leopard and a Snow Leopard server. Is there a way in Workgroup Manager to disallow the student group from running an installed application? I know that I can "always allow" all the rest of the applications, but there is just one that I specifically want to disallow and I don't want to have to be constantly updating an application whitelist.