Well, there is multiple way to do this.
- Trust your users to not install anything weird on their computer
- Create a local administrator account and explain to the users to use this user account to install applications when needed
- Implement LAPS https://www.microsoft.com/en-ca/download/details.aspx?id=46899
All of the above solution will not prevent a user to make configuration change because as soon as the user as "Admin rights", he can do anything. But don't forget the number 1... trust your user. If you don't trust your user, do not give them any Admin rights and use any other distribution software.