Approach to prevent accounts from being added to AD Security groups

Dear Experts

I am trying to find a way in which I would need to prevent the user accounts( standard)from getting added to restricted AD Security Groups,which are in certain OUs.We have accounts(that come with specific prefix like useraccount1,useraccount2 ..etc)which alone needs to be added to those restricted AD groups..When it is violated,it should pop an error I tried to look into GPO approach..but do we have any other query or method to achieve this?

sundas7