JupyterHub internally spawns an instance of Jupyter Notebook so ideally, you would be looking to block the pip commands on Jupyter Notebook.

You have two solutions as per the best of my knowledge since I've faced a similar issue.

1) Write your custom kernel wherein you could choose to not have certain commands which aren't required for your use case.

OR

2) If it fits your use case, you could simply choose to delete the shell itself.

Refer to my answer here for the steps: Turn off magic from jupyter notebook

Ideally, if you are running such a multi-user environment, I'd suggest using Docker.

To run JupyterHub with Docker, check out this link for more info on Universities / Institutes running JupyterHub - https://jupyterhub.readthedocs.io/en/stable/gallery-jhub-deployments.html