You can do this at a permissions level by changing the 'Unenrol self from the course' permission (self enrolment capability) for the desired role (e,g, student)
You can apply this either at a course context (Course Administration/Settings block / Users / Permissions / Check Permissions)
or at a Site level
Site Admin / Users / Permissions / Define Role / (select role ie. student) - locate Self Enrolment capability and 'Unenrol self from the course' permission.
This may be relevant
https://moodle.org/mod/forum/discuss.php?d=60973
Might be worth checking into what happens with a cohort enrolment if you remove the person from the cohort - I think it might delete the data as well.
Phil