How do I prevent users from adding private Google accounts with an Android Enterprise enrollment?

You can prevent users from adding a private Google account by setting the "Account modification" policy to "disallow."  It works for both Device Owner and Profile Owner activation modes.

This setting is found under:  Profile > Android Enterprise > System.