I would disallow logins to the head node, and only allow users to log in to the login nodes. You probably don't have any login nodes, but you can easily create some. These are simply nodes that have an interface on the external network (so people can log into them) and an interface on the internal network.
How can I prevent users from running big jobs on the cluster headnode and force them to use only the slurm batch system?
Where am I?
In Bright Computing, Inc. you can ask and answer questions and share your experience with others!
By application of the cluestick.
Seriously though you can have a cgroup set up for login shells, so you can restrict how much resources a user will use. You could even use old fashioned ulimits to restrict resource usage.
I have never implemented that cgroup restriction for logins, but did look at it seriously once.