Because in offline mode we can add local ressources, without any control, i suggest if there is any sollution to disable the offline mod in project web apps connexion. Saving Changes...
It's been a while... If they're using the desktop client, you might be able to lock it down with a group policy that only allows a specific profile and prevents users from creating new profiles.
You could take away the desktop client, but that limits what you can do.
Honestly, you're better off instituting governance around the process. Let them work offline to run what-if scenarios without committing them. Final edits have to be made while checked in to prevent negatively impacting the resource pool for other projects. Otherwise, they don't get the resources??? Just a thought.
When you have a mature enough team, it is better to give them boundaries, guidelines, and consequences, with clear reasons for them and getting team input where you can, than it is to just take access away. Saving Changes...