Well then this means if this is a IT to deal with. 1. Admin accounts on each computer should be password locked to prevent user installing malware 2. Addon usage and help is with the addon developer 3. Make users Standard so they have no permission to install

This is what every business should do but don't and end up having more problems then needed. If you password lock the Admin account on each computer the Standard user can't install or bypass it. That's pretty simple and then configure your A/V software to block any downloads or installs from happening. Then you have locked the system down from users thinking they can install what they want. My work place does this and it works fine with Windows 10 if your using Windows. If another O/S then you should looked how they do security locks to prevent un-authorized users from installed un-approved software.