Profil Selfserv Installation
Not that I'm aware of but you can at least prevent device level unenrollment with this setting:
No, you basically can't have on-demand profile install/uninstall function of device agent without allowing other functions.
Manual disconnecting of the device agent is automatically re-connected in the device is in the default persistent mode and is therefore not a problem. Apart from disconnecting and un-enrolling (which can be disabled as mentioned by Matt), what operations are you worried that you think can cause problem?