Everything on a Chromebook or Chromebox is accessed by using a url. To prevent users from accessing crosh by either typing in the url or by using the shortcut keys (pressing ‘CTRL+ALT+T’) follow these steps.
Press CTRL+ALT+T to open crosh, look at the URL and copy the part after chrome-extension://
Next open your Google domain management console and go to "Device Management > Chrome Management > User Settings".
Open the desired organisation unit (Tip: this could be at the domain root and you could just remove the setting from being inherited in your admins org unit/group). Then look down the page for the policy setting called "URL Blocking".
Paste or enter into the box "URL Blacklist box" the url address copied from earlier.
To test it, go to on any Chrome device and type in the url "chrome://policy", then click "Reload policies".
Now when you or a user tries to open a crosh terminal tab a message will be displayed saying "Webpage Blocked". This policy change will take a minimum of 30 minutes to apply to the rest of your Chrome devices (dependant on what's set in your Google management console).