Hi Arthur,
This is currently not possible on iOS. There are no API's to disable it via MDM.
The best optoin is to provision users with sevcure email with email proxy. Be sure to configure Secure Email for users by adding the config. via MAM or MDM to autoconfigure their account settings (they still need to enter password once).
Then after users are enabled, send them notice of service change and turn off or block EAS. All email would still flow through Secure Email.
This can be done without Proxy but it will take far more netowrking rules, and policying than by using email proxy, which is far easier.
This will also prevent users from adding additional devices to EAS, will premit you to pull EAS off the edge entirely!