Hey Simon,
It is true that you cannot prevent a user from adding local resources
to their files but if you disable the "New Resource" global permission
for project managers, they will receive a spooler error whenever the
save or publish their plans on the server. This will in a way force
them to deal with the situation by contacting the Administrator and
will eventually teach them to not add local resources to their plans.
If they need a new user, they should put a request in for the new user
to be added and use a generic resource in the meantime as a place
holder. Then when the new resource is added, they can do a replace of
the generic place holder with the new resource in the Build Team from
Enterprise.
Again, the tool does not take away a project managers total ability to
do things in their plan but process is what will ultimately get you
where you need to be. It is key to have well defined processes and to
enforce those processes in order for and EPM solution like this to
succeed.
Hope that helps,
Jonathan Sofer