I don't think there's anything in the concentrator specifically (like a table) that'll tell you what version they are. You could check the Filterable Event Log when they come in (set AUTH and AUTHDBG classes to 1-13 for logging) and that'll probably tell you, but it's a very tedious process.
You can't stop people connecting if they have the wrong version, but you can have the client display a window with a message telling them where to download the client if they're not running a specific version. On the concentrator go to Config - System - Cleint Update and fill out everything here. Click Help for further information on what the options mean.
Of course the ability for the client to display this message only came in on the 3.1 client, so if they're running anything earlir than that even, then they won't be able to display the window even though it's configured on the concentrator.
