Is it possible to stop someone from changing the MAC address of a Windows machine using GPOs?
(There may be network cards which use a fixed MAC address, but I've not yet heard of them.)
As the comments suggest, an Administrator account in Windows can adjust the MAC address, as well as the IP address. A non-administrator account cannot. So, if you do not trust the user, or want to reduce the risk of viruses, you should certainly run a non-administrator account.
However, with physical access to the machine, there are many possible ways to bypass the user account controls, and gain administrator access anyway. Properly securing a machine when someone has physical access is quite complex and depends on the specific requirements.
And besides that, could someone just unplug the network cable and plug it into a a separate device for which they have root access?
The best thing to do would be to have a middle-man device which controls the traffic. For example, with a Managed Switch, each PC can be plugged into a separate port. The physical port number can be tied to a specific IP address and MAC address requirement.
Besides a proper Managed Switch, many Routers, or small computers with multiple ethernet ports have the ability to enforce such restrictions.
(Finally, were you to use a Proxy or NAT, then the MAC address would be reset in that way, but this is probably not what you are looking for.)