Disable Add new module page, install new module link on the Extend page in Drupal 8, 9, and 10

Add this to your settings.php or appropriate environment-specific settings.php if using that approach and wanting to allow this on some environments.

$settings['allow_authorize_operations'] = FALSE;

If you really don’t allow site administrators to access your server directly, this will prevent Drupal from lying to them and inviting them to install modules which they will not be able to do.

New updates

Clearly, other people have also wanted to do this, here they did it with an alterRoutes() function but the admin menu did not respect it:

And finally with Project Browser (for proper composer installs through the UI) being a thing, here they did it with an alterRoutes() a little more elegantly using the update.module_install route name:

Seems this settings approach is still best.

… except that the add new modules page is still showing up for me… ah, because $conf is out and $settings is in for this type of setting. Updated this note above to use correct modern settings for disallowing non-composer extension adding.