I found a partial solution, by using the sumatrapdfrestrict.ini file and disable DiskAccess. That works, but the downside is that it also disables the print dialog. Hence the users can no longer select the printer. The file is sent to the default printer directly. I can live with that, but it would be nice if you had the option to disable disk access, but still allow the print dialog to appear... Is there a work around?

read the manual for what actions can be disabled or allowed but some may be mutual thus one may not contradict the other so try different ones, for copy and paste you can enable just that one

note that current version 3.3.+ has abilities that may via contortions bypass restrictions, (generally most abilities are restrictions aware, but calling browser could be abused and annotation saving naturally allows external access) thus an older version 3.2 may be preferred.

if I set DiskAccess = 0 then I can not open files but to print to my virtual printer that will itself allow disk access to save the output, it is part of windows natural behavior, thus you need to remove from system any virtual file printer such as print to pdf

The print current page function can be a separate command file invocation to keep it from the internal access requirement. You would need to build a command that itself is restricted in print ability and assign to Open in Restricted printing. but I have not tested if that is possible! no that's not possible as open in is naturally blocked.