That is the only way to disable  SP Designer access  to the entire Farm. Take a
look at the following Knowledge Base article for instructions.

http://support.microsoft.com/kb/940958

FYI, there are also other tags that can be used in addition to wdfOpenSite.
They are referenced here.

This setting  is one of the few things where the site still relies on a setting
in the ONET.xml, so you can change it at any time. However, since it appears to
be cached you will need to do an IISreset for the change to be picked up.

Where I'm getting confused is when it refers to the xml  file to edit:

\Program Files\Common Files\Microsoft Shared\Web Server
Extensions\12\TEMPLATE\SiteTemplates\<Service>\xml

We're running MOSS. Which service is that? SPS? It appears that there
is a folder for each template  in here, along with it's own XML folder
and ONET.XML file.

The example in the tech doc refers to WSS:

rogram Files\Common Files\Microsoft Shared\Web Server
Extensions\12\TEMPLATE\SiteTemplates\XML

We don't have an XML directory under SiteTemplates, so I assume MOSS
is going to be in a sub directory.

Service in this context refers to each subdirectory where a site definition is
stored. For example, the Team Site, Blank Site, and Document Workspace site
definition ONET.XML is stored in

\Program Files\Common Files\Microsoft Shared\Web Server
Extensions\12\TEMPLATE\SiteTemplates\STS\xml

Other site definitions are stored in other subdirectories. You need to edit
the ONET.xml for each Site Definition that users can use in your Farm.

Yes, that was the crux of my question. So, to confirm, there is no
way to do this farm-wide in one place. Instead, we need to modify  the
XML file  for each and every site definition used on the farm, as well
as any future site definitions added?

Do we also need to do this on each server of the farm, or is doing it
on the app-server sufficient?

You are correct. It needs to be done to every site definition that you are or
will be using. (Note: there are a number that are only used internally for
upgrades, Central Admin, or Mysites, etc. You don't really need to edit these.)
You will need to do it on every front end server in the farm. Of course you
could package the change up as a solution and deploy it to all the web front end
servers in the farm  automatically using either TemplateFiles or RootFiles
entries.