Is there any way to enforce on a stack or org level what pulumi client version is being used? Essentially want to confirm that users are using the same version, or at least a sufficiently updated one

not currently, I think the cli version is sent to the service so I suppose there could be an org rule to disallow connections from those clients. Raise an issue at https://github.com/pulumi/pulumi-cloud-requests/issues team could take a look

Cool, will do - thanks!