Lock bootloader (block Upgrade Mode)

Hello Dear Khadasians,

We are building a system with Khadas VIM3 Pro, that will be accessible by many people. We want to block any way of flashing another software on it, similar way like locking bootloader on smartphone.

Khadas has u-boot bootloader, but this bootloader can be easily overwritten in Upgrade mode. Which is a good feature for development device. But in our case we need to block it for the user.

Is there any way to do this? Can we somehow lock it so that other users could not enter Upgrade mode?