You could write an alias/wrapper around the hadoop (and hdfs) cli commands that would block this.
For example, spark-submit in HDP is not the real "spark-submit", it can detect if you have exported SPARK_MAJOR_VERSION to the values of 1 or 2, then it forwards to the real spark bin folder
Essentially, put this script somewhere, then you make sure it's first in the $PATH for all users
#!/usr/bin/env bash
if [[ "${@:1:2}" = "namenode -format" ]]; then
echo "ERROR: Namenode Formatting disabled"
exit 1
fi
exec hadoop "$@"
Sample usage
$ ./hadoop namenode -format
ERROR: Namenode Formatting disabled