I don’t know if this will disable the ability to run macros but this technique removes a lot of worries for us. We only install Client Access .CAB files 1, 2, and 9. This gives our users all the power they need including mapping to drives on the IFS.
If you look at the group of files in your Client Access installation folder you will see a group of file with the .CAB extension. We simply delete all .cab files except 1, 2, and 9, then run the install. My info is based on V5R2 .cab files. Some files added since then.
In the five plus years, none of our users have needed any functions beyond what is provided in those three files.