Use azure aks get-credentials --admin can get kubernetes admin config file and azure aks get-credentials can get only user config file on azure.
How to set something to deny user run azure aks get-credentials --admin?
well, be default they cant run it, unless they have specific azure permissions. so by default you dont have to do anything. they shouldnt have this specific permission:
Microsoft.ContainerService/managedClusters/listClusterAdminCredential/actionwhich they would get if they are contributor for the AKS resource or resource group. They need this permission to get user credentials:
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action