Prevent WordPress installing plugins and themes via Admin

You can simply delete the lines from your wp-config.php.

define('FTP_HOST', 'yourhost.com');
define('FTP_USER', 'youruser');
define('FTP_PASS', 'yourpass');

However, this does not automatically mean that you are secure. There are a lot of backdoors where malware could be injected, starting from the server, security-issues in your plugins, outdated software etc.

Please be sure to check for all the latest versions.

Also, if you have set your file permissions to FTP-only, you will not be able to upload media or update plugins/WordPress if you do not change them.