If a user doesn't have local admin rights, what they can do on Windows 10 is already restricted.  This was not always the case.  Using Group Policy you can further restrict users from installing or changing Windows configuration.  You can also use GPO's to install software and run updates to software.

http://www.thewindowsclub.com/how-to-prevent-users-from-installing-programs-in-windows-7

https://community.spiceworks.com/how_to/8595-deploy-msi-s-through-your-network-with-gpo