Preventing certain users in container from executing any command


I’m trying to make it so that in my docker image, which has a few users created with --shell /bin/false, these users should not be able to get an interactive shell by doing docker run -it <...> --entrypoint="command" <...> or docker exec -it <container> "command". Is this not possible? I’ve added /bin/false to /etc/shells as well. Any help would be appreciated, I’ve run out of ideas.