You have to lock down pretty hard if people change ports, but the firewall is a good place for this; prevent the IM working, and you remove the temptation to download