You can't do this as your end-users have to be dialog to use CRM. Any user with rights to login in the webclient of CRM can always log into the SAP GUI. The only thing you can do is make sure the user has no S_TCODE authorizations, which will prevent them from executing any dialog transactions in the SAP GUI.
However keep in mind you still might need to keep SU3 authorizations(not sure about S_TCODE for SU3) to allow the user to maintain personalization data in the webclient.
Take care,
Stephen