Can users be stopped from editing their own user record?

Write trigger on users object and show error if user is not system admin and he is trying to update user record..

I would just create a custom setting to toggle on/off plus a standard validation rule, I haven't tried it personally, it may not work. But would try that before code.