I've made some changes locally to my new Moodle install (v1.1.1, and it's working nicely) which allow editing teachers to change the course settings to prevent pupils self enrolling.
This is a copy of the help file I wrote which may explain:
Students can enrol themselves
Students are able to enrol (and unenrol) themselves onto the course. If an enrolment key has been set, this is still required.
Only Teachers can enrol students
Students are not able to enrol (or unenrol) themselves onto the course. They have to be enrolled by a course Teacher.
The reason I did this was because we've had instances of pupils guessing the enrolment key for some courses.
Not sure if this is something anyone would want to include in the distributed version?