Blocking everyone from steaming music at your firewall is probably the easiest thing. I am in the middle of doing that right now. We're testing each service on our firewall and allowing a few and blocking most. We need RAM files allowed but we're blocking MP3, WMA, WMV, MPG, MPEG, and so on.
The easiest thing to block the person from installing programs is to drop their level from superuser to user. You could do a GPO on your domain but as a superuser it wouldn't be too hard to get around. With a few clicks in Google the person might be able to get around some of the policies if they were technically inclined.
What you really need to do is make and enforce a written policy against streaming music. First offense write up, second verbal and write up, third you show them the door. If you make a policy but have no real consequences you might as well have no policy.
Good luck!
Cheers
Rob