How to prevent a Ubuntu server from being updated?

I am creating a test system that will be run by others. It will have some kernel mods, and some of the default software in /usr/bin will be replaced. Because of this, I want to prevent the users from doing "sudo apt-get update" or "sudo apt-get install". These systems will not have any valuable data, and will mostly be behind corporate firewalls, and thus it is safe to completely punt on security-based releases.

FWIW, moving apt-* and dpkg* to /usr/dontusethese does not work because some other processes like (gag) MOTD updating relies on them being in /usr/bin and whine if they are not there.