In RTC 6.0.2 we added a feature that lets you lock streams and components to prevent deliveries to the files in those streams or components. Stream and component locks work in a similar manner to file locks but apply to the entire stream or the entire component in a stream. When a stream or component is locked, any attempted deliveries by users who do not own the lock will fail with an appropriate error message. The user that holds the lock can still perform deliveries to the stream. A lock does not only prevent deliveries, it also prevents any operation that affects the files in the locked component or stream. For example, a component replace is also prevented.

See:
-New & Noteworthy Mention: https://jazz.net/downloads/rational-team-concert/releases/6.0.2?p=newsDetails#stream-locking
-Stream/Component Locking Demo Video: https://www.youtube.com/watch?v=b8QwzwUF2ZY
-SCM Command Line Client 'set lock' command: https://www.ibm.com/support/knowledgecenter/SSCP65_6.0.4/com.ibm.team.scm.doc/topics/set_lock.html

Prior to 6.0.2, you could do what is described in the tech note by changing the owner of a stream to a Team area or Project area in which nobody has deliver rights (this is also clarified by Ralph in his answer). You can change the owner of a stream by opening the stream in an editor in RTC Eclipse for example. Also, another approach might be to add a deliver advisor in the process spec to restrict deliveries to particular streams. By protecting your stream by particular roles or users, you can effectively lock the stream down.
"http://jazz.net/library/article/215#protect_some" describes how to protect individual components in a stream, the same approach can be used to lock down the entire stream.