Right now there isn’t a way to prevent a user of Klok from adding a subproject to something that you published from the console. However, if the user creates a sub project and tracks time against it, when they submit the time back to the console, it should appear to be tracked against the nearest ancestor that came from the console. For example, assuming you published the following structure:

a
a.a
a.b
b
b.a
b.b
b.c 
b.c.a

If a user creates a subproject under the “a.b” project called “a.b.a” and tracks time against it, that time will look like it was tracked against “a.b” in the console. Project “a.b.a” will not appear in the console at all.