Yes - you can do various things to prevent people using the core service, but I fear your problem is not a technical one, but a management or communication one. Given access to the Tridion GUI, a reasonably savvy user can create huge publishing jobs. They can also delete and move things. So if you deny them the use of the core service, you may perhaps not succeed in solving your problem.
Talk to your users.
You should probably compliment them on how they've managed to use the core service to solve their day-to-day problems. As others have noted, basic security allows you to dictate which actions a user may perform, but does not prevent that user from automating those actions. Sure - you could implement customisations to prevent a given user performing more than a certain amount of actions, but why?
Your basic problem is to share out fairly access to a limited resource. Your end-users don't want extra restrictions. Trust me on that. If you get them together and explain that they need to share better, or you'll need to impose restrictions, they will be very glad to have the chance to work together better.
If, after everyone getting their heads together, the conclusion is that Tridion just needs to perform better, then be happy. Tridion's architecture is just about as scaleable as you can imagine. If you need to add extra servers, Tridion will cope just fine. All you need to do is assemble the business case, make a plan and execute on it. Tridion will cope.