There used to be options to disable download perms per-user which is no longer available and I think it'd be a good idea to add an additional option to revoke mod queue bypass from certain users which should be able to upload but not necessarily bypass moderation queue.