For security reasons you do not want to allow any processes to be designed with...

No, this is a base task in the App Designer process editor and it cannot be disabled, you will need to restrict who has access to App Designer to create processes.

The capability 'script task allowed' can be removed from the capability group for users you want to prevent from using script tasks.

A validator property can be set to false to disable script tasks in the activiti-app.properties file.

If you synchronize in users from external, you can modify configuration in the activiti-ldap.properties to prevent users from using script tasks 'ldap.synchronization.scripttask=false'.