No, not that I'd know of. You could maybe remove the dmsetup binary from the system and only keep it in the initial ram disk, which would be enough to set up the encrypted volumes when the machine booted, and then chroot the initial ramdisk out of reach in the booted system, but this would only be a stopgap measure. You might be able to improve on it with apparmor profiles a bit, but not make it watertight (especially not against a simple download of the binary from the network).
That said, Luks is designed to keep data confidential only when it is at rest. If you're trying to avoid having the luks key stolen while the container is in use, that will most likely turn out to be hopeless.
To expand on that a bit: Even if the dmsetup binary could be coaxed into not outputting the key, root would still have access to /proc/, which would allow him access to system memory, to the encryption and decryption etc. The only way to keep the key fairly safe would be to prevent the kernel itself having access to the key, and that's obviously not possible with just software.