Under Administration > Settings- Whitelisted file extensions > Disallow extensions which could be a virus (BAT files, etc,)

Put Control Room on a separate network, one not accessible by clients.

Check the Audit Log for user logins that occur at unusual hours into the Control Room, share this information with their user's manager, and check the user's uploads for threats

Ask IT to disable communication between the client and Control Room