I *think* you can do it by taking away the Model Management --> Model Write --> Model Maintenance Mode privilege from the user group.
What I can't remember is whether taking that away also prevents a user from scheduling maintenance mode via the scheduler or not.