The first policy I set was Computer Configuration/ Policies/ Security Settings/ Local Policies/ Security Options/ User Account Control: Detect application installation and prompt for elevation. This worked pretty well except it did not block firefox. Then I set Computer Configuration/ Policies/ Windows Settings/ Security Settings/ Software Restriction Policies/Security Levels/ Basic User. This seems to work better. Then I set User Configuration/ Policies/ Administrative Templates/ Windows Components/ Windows Installer/ Prevent removable media source for any installation.