[johngalt]

Here are your options:

Revoke local admin privileges. It will stop a lot of the click-click to install bullshit, but it also means you will get a lot of calls about "access denied" whenever they want to update an app that needs admin rights. Give them an admin account to install/update software separate from their normal account.

Simplify the device by going tablet/chromebook. Probably means you will get a lot of questions regarding how to use/setup the new OS.

Shorten the loop on backup/rebuild and let them hit the iceberg. Good backups and fast imaging with drivers pre-loaded can make cleanup a lot easier/faster.