Obviously, no, disabling PowerShell would not satisfy that requirement. However, if the malware cannot run the .ps scripts encoded inside of it to encrypt your computer, or enumerate local computers and spread to other computers because it requires PowerShell to do it, then it does go a long way towards protecting corporate interests when backup system images are stored on a local drive hot-connected to each user's computer. The idea of an air-gapped storage is to have an air gap switch on the USB device, or have the backup device turned off. But this requires a level of user interaction when running system images. It is better to script and run the system images (via something like Macrium or Acronis) and have these saved in an air-gapped storage device under the control of the system administrator. Then these images could either be run at the exact time when the storage was going to be hot (live connected).