Most of your staff uses OSX as main operation system. The problem is that recently we were attacked with some odd malware: users are getting zip-file via mail, and when they open this zip file, they execute a binary keylogger malware, that is inside this zipped file. (One click is enough).

We have some non-technical limitations and due this limitation we can't configure user's mail servers. But actually we have physical access to their laptops.

As far as I know, there is possible to mount user's home directory without "x" (execution) permission in Linux and *BSD. So users can't run some binary file inside home directory.

Is it possible to configure OS X so that user can't execute files inside /Users/?