Open secpol.msc
 from the Run menu to open "Local Security Policy", from there navigate to Security Settings -> Local Policies -> User Rights Assignment
. In that subfolder find the option for Shut down the system
 and add the group named Console Logon
 to the list then remove the other groups from the list.
This will have the affect of only allowing people who can physically log on to the console session to be able to shutdown the computer.