Currently users can alter their own preferences on whether to use auto-login / what the auto-logout timer setting should be set to.

I would like to enforce this administratively for users, disabling auto-login and having all sessions die after 15 minutes.

The only exception would be a user who has been specifically permitted to remain logged in indefinitely - e.g. a kiosk/wallboard.