Could require (or highly recommend) a 1-time course/quiz before they withdraw for the first time. Some kind of flow that teaches them about the drawbacks of third-party custody and how to self custody simply and safely.

it might be ineffective but it's a touchpoint. Maybe the 5th or 10th time they hear about self custody, they'll start to listen.

At the extreme, you could only allow withdraws to xpubs. Instead of entering an address, you require an xpub and generate unique address for each withdraw. I don't know any custodian that gives you an xpub so you can almost guarantee they withdraw to keys they control. Not the best UX tho...