I'd have to agree that removing tha ability to remotely log on to the server will hinder the ability for the DBA to do their work.

As long as SQL Server is running properly they could log on to the SQL server using SSMS, enable cmdexec and run all of those nasty changes on the server in any event so I don't see where you are gaining any security benifit.

If SQL server is running slowly or has crashed then they will need to identify why and the ability to get to the OS to diagnose the problem will greatly assist this. I have examined the event logs via SSMS but when it can take a minute to scroll the log rather than virtually instantaneously when logged on to the server itself there is no contest.

Bear in mind that the occassions they will need access to the server are generally the same occassions where accessing things via SSMS is a problem.