But i have found a solution which should work. Block these 8 IP addresses:
128.31.0.39
128.31.0.34
86.59.21.38
194.109.206.212
216.224.124.114
80.190.246.100
213.73.91.31
208.83.223.34
These are the initial directory authority servers.
I tried it out and it works as long the client was not started before. Because, in this case, it already has a list of other directory servers. Don't know if they expire after some time.
I found the IP addresses in the file "src/or/config.c" of the tor source. Search for "default directory authorities" in the file.
Can't do that sorry, they are software developers.
They need local admin access to their PC's and always installing and uninstalling stuff. I'll try to block TOR download though.