Control user(s): ability to use / access to <iframe> - how?

To complement the answer by @simon and addressing this specific point, you can set max oneboxes per post to 0 to disable oneboxing as a whole, which will also disable content like videos from Youtube and Vimeo.