Edit the sudoers file.

## user is allowed to execute halt and reboot 
whateverusername ALL=NOPASSWD: /sbin/halt, sbin/reboot, /sbin/poweroff

The relevant polkit policies should be defined here: https://github.com/systemd/systemd/blob/main/src/login/org.freedesktop.login1.policy

Disabling is done with some rules like this: https://bbs.archlinux.org/viewtopic.php?id=152565

polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.login1.power-off") == 0) {
    return polkit.Result.AUTH_ADMIN;
  }
});

Some other examples: https://gist.github.com/grawity/3886114

What if you try another interface, like shutdown -P now or poweroff -p?

What about systemctl poweroff ?

Well, the logic in polkit is, if you have direct physical access to the machine (not SSH, actual keyboard, and so on), in general nothing stops you from just pressing and holding the power button. So giving a local user the right doesn't make worse.

To disable the behaviour you need to find the appropriate polkit rule in /usr/{lib,share}/polkit-1/rules.d and create a file with the same name in /etc/polkit-1/rules.d pointing to /dev/null.