By default in Office applications, you can choose IRM protection Templates or Ad-Hock protection (adding specific users).

In some environments, you may want to limit this to just Templates.

More Information

We can create a group policy that disables these by their Control ID so what you will see will be similar to this:

The two critical IDs:

7991 (Disables Restricted Access)

10014 (Disables Manage Credentials) - Only for Office 2010

You will need to add the Office Administrative Template files for each version: (2010) (2013)

When you edit the policy you will go under Microsoft Word (or whatever application you are using)\Disable Items in User Interface\Custom

In the Dialog choose Enabled and then choose the "Show" button to add the individual IDs.

To prevent users from using Add-Hock protection, you will add 7991 and 10014

When the users refresh their policy these options should be grayed out.