One option for dirty frag via selinux, dependent on user cases where ipsec is needed

$ semanage login -a -s staff_u -r s0 user_A

$ cat << 'EOF' > /tmp/deny_userns.cil
(deny staff_t self (user_namespace (create)))
EOF

$ semodule -i /tmp/deny_userns.cil

# Test:
ssh user_A@myhost 'unshare --user --net /bin/true && echo VULNERABLE || echo BLOCKED'
unshare: unshare failed: Permission denied
BLOCKED

$ ./exp
dirtyfrag: failed (rc=1)