With a rooted phone, you would have to decompile system/settings.apk using apktool or similar (in a pc with the android sdk installed).
Edit its xml to remove, just delete, the thetering and portable hotspot menu, and then put the modified settings.apk back into the phone.
That would make it so they cannot activate it via the settings menu, but the phone would still be able to by using 3rd party apps.
Look into decompiling and compiling system apps with framework and apktool. Its a lot to put in the post, but there are great tutorials in the xda community. It's time consuming, but once you get the hang of it, really easy.