The control for renaming files is in the Admin > Users/Groups > Folder Permissions or State Permissions. This is the out of box method for controlling Where (Folder) and When (State) users can add or rename files. The problem is the Add and Rename are one and the same so you can't allow Add without also allowing Rename.
You could use Templates to add files, so you can turn off the "Add or rename file" permission. That way would guarantee no renaming.
As Steve says, the Add/rename permission will do it. Since add and rename are combined into one permission, users need the folder permission, but only the initial state in the workflow should have that permission. This way they could add the file and rename it only when it is in the initial state.
In answerr to your second question, no it cannot be done when the file is first added. But you can right mouse on the field on the data card and "Generate next serial number" after the file is added. So the proceedure is copy the file into the vault, right mouse and generate new serial number, and then run the dispatch script that renames the file. Finally transition the file into the next workflow state that does not have add/rename file permissions.
Thanks Wayne and Steve,
Wayne I think you helped us with workflows, currently our initial state gets routed back after if it fails approval or after a transition. It makes good sense to have a true initial state!