Preventing the user from installing/using software that has not been approved by the company, by enforcing software policies on employees machine will suffice, combined to network authentication such as only those policy-compliant machines can access the network. This makes the workstation nearly a simple
kiosk machine. In finance and healthcare industry, it should not be considered inappropriate to enforce a kiosk mode to operational employees.
The inability to run a software that may connect to Tor is the key to prevent users from using Tor, if browser (e.g. onion.to proxying) is not part of the threat. But normally you would have a whitelisted list of sites available in protected environments.
This, in the real world, often collides with the needs of IT staff. In most companies, the ability for the IT, who are not necessarily software developers/engineers, to run any software or to write custom scripts is a requirement. For sake of discussion, let's assume that is the case.
Of course you cannot prevent your sysadmin to run Tor and you can't also lock his machine down to a kiosk for just that "threat", otherwise you will prevent extraordinary out-of-process activities such as fixing problems with machines or network. In this case, I would recommend to employ a policy such as the sysadmin machines with privileged software configuration are normally connected to a non-sensitive network, and eventually Internet. If a sysadmin needs to access the sensitive network where protected information is stored, then he/she shall phisically connect his/her laptop to a different plug, and record the event into an audit trail. Such audit may also be accomplished by a comment on a support ticket "I am gaining access to machine
10.100.200.10 in order to complete the task".
In short words, preventing anyone from using Tor is a strict requirement that is difficult to enforce, however a reasonable reinterpretation of the requirement should satisfy any regulator by adopting the security principle that users must be able to run only the least minimum set of software programs to accomplish their duties (a variation of the least minimum privileges principle).
And anyway Tor itself is not a threat, it is a medium that can either be abused by insider traders or other unfaithful employees or pose a risk to existing untrained employees.