You could consider using an app locker, e.g. Smart AppLock (App Protector). Photos are taken by the camera app, regardless of whether you invoke it from the app drawer, a shortcut, widget, or via pressing the camera button. So if you lock the camera app (and the playstore app, so the user doesn't simply install an alternative camera app -- also make sure to disable unknown-sources and lock the settings app), only somebody knowing the password/pattern you've set up to protect those apps can use them.
Explanation: While blocking access to the camera app, this does not affect the barcode scanner. The barcode scanner for sure accesses the camera hardware, but not the camera app: the latter would not know what it aquires (just that it focusses on "something", but it's not recognizing what this "something" is and so would not know whether it aquired a barcode correctly). You can also verify this by checking the permissions the barcode app asks for: its permission list will for sure include
Hardware controls: Take pictures and videos, which means it accesses the hardware directly. For accessing it via another app (e.g. the camera), it would not need this permission but rather call that app via an "intent" (see: what is intent in android?), so that called app would do the intended action.