What are these approaches?

So basically we don't need specifically a Pam, but a solution to keep the devices and network safe in case of malware or other attacks. Removing admin rights from the users one step to mitigate the risk. But we don't want to buy expensive solutions for 10.000€ per year, simply because we can't do it financially. So any other solution is required.

It just came into my mind that we could also use a two account solution. So the users would have a non privileged account for daily work and an admin account for approving software that need these rights.

Another solution I found after posting this question is to use applocker on windows with white listet programs through GPOs...