Disabling TCP/IP cfg

For your first problem (lock down IP settings):
Uninstall the IP protocol in the network conrol panel (if you dont use IP, If you do and the only think you want to do is restrict the IP settings then read on). Restrict access to the control panel thru the use of a policy.
For your second problem:
If what you need is access to windows without logging on to the domain and your domain controller is down, and you want to gain access to the network then the only way to work around this that I know of is:
Restart the computer in Safe mode (by holding down ctrl key when windows boots). Open up regedit and change the value of the following key from 1 to 0, the key is
"HKEY_LOCAL_MACHINE>Network>Logon>MustBeValidated".
Restart the computer when the network prompt comes up you will have to click cancel. If you want access to the network you will also have to change the default logon type to windows logon instead of microsoft network logon or you will have to uncheck the box logon to windows nt domain controller.

I don't know of any way to restrict TCP/IP when they don't log into the domain. Win98 isn't secure and so doesn't enforce any login requirements. The most you can do is lock them out of the domain resources.

If you only need to restrict a couple of programs, you could try moving those programs to a share on one of your NT servers and create a link to them on the Win98 machine. In this case, they will stop working when the user doesn't log in and cannot access the share.

The two main files you would probably want to move are:
C:\windows\telnet.exe
C:\windows\ftp.exe

This can be bypassed fairly easily if they copy the programs from somewhere else, but it should help.