Have a fine mesh on a 45 degree angle that will allow the whole beans to slide down the mesh, but that water will pass straight through. The beans slide into a permanently covered bean receptacle that is impossible to add water to without disassembly (which should be an option for cleaning).
Beneath the mesh you could have a catchment to collect small bean particles and any water that the user tries to add, and the design and placement should be quite obvious that water poured onto the mesh isn't going anywhere. Conversely, let it collect there and go nowhere. If that catchment overflows, it goes onto the counter.
I worked at a place where someone (who we never caught) put some chocolate coffee-bean-look-alike candy from Trader Joes in the grinder. All the new peeps (myself included) got 'blamed' for being ignorant, and lots of signs went up. I hate signs because the can never anticipate all scenarios.
My next work place had someone try to cook bacon in the toaster oven. As it turns out, this is not a viable way of frying bacon and it caught the toaster and part of a cabinet on fire. Later that month the building management started doing regular fire drills. We'd take the opportunity to tell the story about Mike and his bacon as we stood on the street.
I'd say people were idiots, but that's a negative view practiced ineffectively by the first place. I'd rather see it more like people incorrectly assume what they are doing is right, and never question if its not. Silly humans.
Signs are also stupid because they're built on two faulty assumptions: one, that the morons read them, and two, that the mistakes of the future will be carbon copies of mistakes of the past. There's no bacon frying sign over the toaster oven at my work, and I've seen people cook bacon in the kitchen. But there's a sign over the sink listing things that shouldn't go down it, as if nobody has one of these things at home.
I cook bacon in the toaster oven all the time... it's the best way. As long as your toaster oven can maintain 425F / 215C constant temperature (rather than having the element on permanently) you end up with beautiful moist but cooked bacon without it being crispy and burnt.
My previous workplace had someone attempt to cook a ribeye steak in the toaster oven.
It actually worked, but management was angry the third time he pulled it and set a flat no-meat-cooking policy on the toaster oven (enforced via clipart signs).
This was proposed, but especially if the bean capacity is large getting the beans wet is a big no-no. It also does nothing to dissuade users from adding more water for whatever reason (until it overflows). Thus you get potentially moldy beans, and a tray full of gross old water.
Only a serious idiot would ever try to pour water on that. The beans slide down the wire mesh into the main bean compartment which is otherwise inaccessible.
Some machines have a wire filter like that to stop objects getting into the water tank; users might misinterpret it. I still really prefer the ones where you have to take out a basket, which is obviously not capable of holding water, and fill it with beans. Sealing it and getting the beans is harder.
For a user to misinterpret and pour water on what biot described would require such a fundamental misunderstanding of common sense and what I can only hesitatingly call "physics", that I don't think it is possible to protect the machine from such a user - except, perhaps, to hope that they will be foiled by the doorknob whose operation they must decipher in order to enter the break room.
The key advantage of the mesh is not to perfectly prevent water from flowing along it, but to be something that even the most caffeine-deprived user would not accidentally try to pour water on. Even if it does nothing mechanically to prevent water from entering the machine, it will psychologically prevent misuse.
The mesh wouldn't need to be that fine if it just had to exclude whole coffee beans.
I think I'd use a bottomless bean bin that pulls out with a handle. While it's pulled out, it's over a grid that lets water pass through (and ideally makes it clear that any water added is just going to be dumped right on the counter). When it's pushed back in, the beans fall into the actual bean reservoir.
Beneath the mesh you could have a catchment to collect small bean particles and any water that the user tries to add, and the design and placement should be quite obvious that water poured onto the mesh isn't going anywhere. Conversely, let it collect there and go nowhere. If that catchment overflows, it goes onto the counter.