A platform manager needs to disable users' ability to update their username via the Profile Fields task in Core > Security > Profile Access > View/edit Profile Fields.