The current approach to this problem is /deny op jerk

It works even better than the suggested idea because they can't mess with the server at all without op.