You're close. This will make it ask for a password before enabling/disabling networking:
sudo gedit /var/lib/polkit-1/localauthority/50-local.d/networkmanager.pkla
Paste in the following:
[NetworkManager1]
Identity=unix-group:user
Action=org.freedesktop.NetworkManager.network-control
ResultAny=no
ResultInactive=no
ResultActive=auth_admin_keep
[NetworkManager2]
Identity=unix-group:user
Action=org.freedesktop.NetworkManager.enable-disable-network
ResultAny=no
ResultInactive=no
ResultActive=auth_admin_keep
Save and reboot.
If you want to disable altogether, set ResultActive=no as well. Of course, everyone would have to be a member of the user group, so make adjustments to the group name/memberships as you see fit. Auto-reset, of course, is far easier :-)