IP restrict all profiles so that the user can not login into the salesforce instance outside of the company.
Within the profile place in the ip range of your company.
This also takes away the use of security token keys, which the user has no ability to create one.
|The System Administrator Profile, notice the Login IP Ranges Related list Link.|
|Go to the Login IP Ranges Related List and Click New|
|Place in the ranges of IP within your company for the Profile|
|Now if you as the system admin profile go under My Personal Information, you should not see Security Token Key Reset Link.|