You could use a short response timeout (<1s) to make it impractical for human players to participate - for instance, that's what Battlesnake does (https://play.battlesnake.com/). Players provide an endpoint that follows the required API and their code never leaves their machines.