As described in https://github.com/openshift/enhancements/pull/1821,

the default way to opt-out from the NoRegistryClusterInstall feature is throught the deletion of the InternalReleaseImage singleton resource.

This anyhow should be allowed only if (any) of the releases handled through IRI is not currently in use in the cluster.

From a technical point of view, a new ValidatingAdmissionPolicy should be created for machineconfig/v1alpha1 InternalReleaseImage resource, checking that the current ClusterVersion version content does not match any of the IRI ocp release bundles