Block the ports it uses (SIP?) or block everything, force users to use the HTTP proxy (or use the proxy in transparent mode) and disallow the TCP Connect method with the proxy.
If you use the SOCKS proxy, make sure you require authentication, and don't give out the logins, esp to untrusted users.
