Change the user's group to sysoper from sysdba. Do you not want this person to have sysoper privileges as well, or are you only concerned with sysdba?