Is it possible to restrict/deny the submissions based on the device ID? Basically I don't want the field officers to change their handsets, and submissions should come from approved handsets only. The username/password combination would not work here because they can be entered in the new handset too.
If submissions cannot be denied at the ODK Collect level, can we separate them in Aggregate, by comparing them against some approved list of device IDs?
Denial at the Collect/Aggregate level may be possible; I don't know enough to confirm or deny.
But it's certainly possible to collect the Device ID so that you can filter them later on after output; in XLSForm you can add a question of type deviceid, subscriberid, and/or simserial and somewhere between those you should get something workable. In ODK Build, just add a Metadata question and the options should be there for you to choose from. And in plain XML, this page has the relevant instructions but essentially you want to add something like type="string" jr:preload="property" jr:preloadParams="deviceid" to a <bind/> tag to automatically bind the data to an instance location.
I can confirm that it's currently not possible to deny submissions at the Collect level. You also cannot deny them in Aggregate.
If the filtering that Clint described is not adequate, I'd be interested in learning more why denying via device ID is needed and how you'd imagine it working. Please post in the Features category and we can carry on the conversation there!