Disable or restrict the 'Add Tab' feature

The ability to add tabs is permission-based.  In the default data set, the permission is assigned to Authenticated Users in the file uportal-war/src/main/data/default_entities/permission_set/Authenticated_Users__ADD_TAB__UP_SYSTEM.permission-set.xml. It's recommended to change the group from Authenticated Users to 'Portal System' to allow admins and layout owners to add tabs.  However you can adjust the group(s) as appropriate.  Add multiple <group> entries for multiple groups.  

Should you choose to keep the filename consistent with its purpose, it's recommended to copy the file to an institution-specific file, modify the copied file, and delete the original file so you don't have the original file added back in when merging in changes.