I don't think you can do what I understand you want to do.
In every situation that I've seen...there are always at least two entities with total control over registry entries: System and Administrator.
As I understand it, when an Admin/User installs a program (or attempts such), registry keys are written to as a result of the install process which has been initiated by an authorized person. I don't think that a user can authorize such writing...and, at the same time, attempt to deny it.
What most of us do is just kill the startups after the registry/file entries have been put in place by the program installer. It's simple enough to do so, using a program like AutoRuns for Windows - http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx
If you decide to use Autoruns, please read the instructions for using it and note the different tabs. For ordinary startup items, I suggest that you just take a look at the Logon tab. All of the other tabs involve processes which ordinarily do not have to examined/changed and some can cripple the system.