Yep. A full moat is the only sure way, and indeed, the OPSEC lectures and even pre-announced severe punishments will never be 100% — there is always some idiot who thinks he is special and rationalizes it in his head. Allowing traffic to only a small pre-vetted whitelist of sites works only until someone fires up a VPN, which again, no amount of lectures & punishments will prevent.