I think the easiest way to do this will be to disable the apps on the forwarders. On the deployment server, edit app.conf for each of the apps that are distributed to the UFs, adding the following
state = disabled
Then reload the deployment server so it will distribute the updated/disabled app to all the forwarders.
A disabled app is completely ignored, so this effectively disables all the inputs.conf and outputs.conf that are configured in apps. The only risk may be any UFs that have set inputs or outputs in etc/system/local - hopefully there are none of those in your environment.