You can use Polkit rules to control the GUI shutdown privileges (the shutdown command isn't affected, and needs root as usual). A set of rules like in this answer should do. Create a .pkla file in /etc/polkit-1/localauthority/50-local.d/ (say 00-disable-shutdown.pkla):
[Disable Shutdown, etc. for all users]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot;org.freedesktop.login1.reboot-multiple-sessions;org.freedesktop.login1.power-off;org.freedesktop.login1.power-off-multiple-sessions;org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions;org.freedesktop.login1.hibernate;org.freedesktop.login1.hibernate-multiple-sessions
ResultAny=auth_admin
The auth_admin policy will require that an administrative user (by default, members of the sudo group) authorize it.