Zedwork

Greetings.

I'm no coder nor I intend to intrude in any way with Zedwick awesome work regarding Zedwork.

There is a simple way to prevent anyone to even set a "foot" above The Nether ceiling.
I have used this code before on a vanilla server with total success.
This code as been tuned for 1.12.2 but the concept it comprises can be easily modified and for sure compacted and simplified by Zedwick for the 1.13 version.

Always active and repeating command block:
-> scoreboard players tag @a[m=0] add Nether {Dimension:-1}

Always active and Chain Command blocks:
-> execute @a[tag=Nether] ~ ~ ~ scoreboard players tag @s[y=128,r=1] add NetherCeiling
-> execute @p[tag=NetherCeiling] ~ ~ ~ tellraw @a ["",{"selector":"@s","color":"light_purple"},{"text":", you're not allowed in ","color":"green"},{"text":"The Nether","color":"red"},{"text":" ceiling.","color":"green"}]
-> execute @a[tag=NetherCeiling] ~ ~ ~ tp @s[y=128,r=1] 0 64 0
-> scoreboard players tag @a remove Nether
-> scoreboard players tag @a remove NetherCeiling

*Instead of command blocks, a function can be created.

Not sure if there's something I've missed, but is there a point in restricting roof access? Just curious, not challenging the idea.

Nether roof access is not allowed as it is an exploit. Bedrock is there to be an unbreakable barrier, and passing that barrier requires exploiting such things as ender pearl behavior or glitches in portals that seem to chuck people up there lately despite them trying to use the nether portals normally.

Unfortunatly, while this method would work great for preventing people trying to obtain access it also punishes people just trying to legitimatly use the nether hub who happen to get caught in the bug. I (and some other people I would think) have put nether portals above high traffic areas such as blutopias hub so people (ie me) can get back down after being glitched up there and this would remove the ability to do that. It'd be like making all nether portals have a small chance to put you in spawn, rather than letting people build thier own escape routes from the sparse bedrock plane.

I agree with Dax' points.

Rather than teleporting them to the central nether hub, it may be possible to create a looping function which can check the blocks in the column below the player to find a safe location to move them down to. A tricky one to get right, but it should be possible.