One way would be to give them read-only permissions - if that's feasible for that particular database. You would have to have user-level security setup for that database.
I haven't tried it, but if you gave them an MDE instead of a MDB to play with, I don't think it can be converted.