It is easy to simply add this to the GPO, and just add it to the deny list as deny access to c:\windows\system32\timedate.cpl. OR
GPEDIT > Local Computer Policy > Windows Settings > Security Settings > Local Policies >
User Rights Assignment > Change system time and make sure that the user and any groups that the user belongs to are not allowed.
U can also run gpresult /v on a computer to check with policy’s are applied.
Be sure that users r not running as admin rights.