For Reboot and Halt this works. Setting SuspendCommand= does nothing. Suspend still shows up in the menu, and hangs the machine.
Create your own GDM theme and customize exactly how you want it. Here's ours, users have no access to anything but logging in.