I would think you'd want to do the exact opposite considering that 2G/3G is in the process of being sunsetted:

https://www.digi.com/blog/how-to-stay-ahead-of-the-3g-network-sunset/

With that said, I'm not sure how that could be accomplished on your devices unless they have a configuration layer like Zebra's MX that supports that level of granular configuration. 

If that configuration is exposed within the Settings app you could attempt to leverage the watchsettings SOTI script to see if SOTI can detect the change and then distribute it with the writesecuresetting script. 

we want to block 4G band for all our devices. 4G causes loss on data connection (private apn)

if there is any script that we can push to all devices, we are grateful

Are you able to perform that configuration manually on a device in anyway? Has the manufacturer provided any other mechanism for providing that level of control? 

While some Samsung device models support something like

   writesecuresetting -glob preferred_network_mode 0,1
   writesecuresetting -glob preferred_network_mode1 0

to limit cellular to use 2G/3G only with Android Plus device agent,  this feature is likely not supported by most other device brands or models.

Are you able to perform that configuration manually on a device in anyway? Has the manufacturer provided any other mechanism for providing that level of control? 

Yes, we can change these bands, manually, from Settings-More-Cellular Networks-Preferred network type. Here we must set only GSM/WCDMA, but now it is forced to using GSM/WCDMA/LTE. I cannot change it from SOTI policy

send the soti script watchsettings on to one of the devices before manually making the change then see if SOTI is able to detect the configuration change by checking the Logs for the particular device in SOTI. If SOTI can detect the change there is a chance that you can use writesecuresetting in order to configure the values but that isn't always guaranteed to work with each manufacturer either.