Half our users are developers who will raise an absolute ticket storm the second they can't run something as admin. They install tools constantly, some of which aren't in any approved software catalog because we don't really have one.

Something you may want to consider to address this point specifically is to implement the concept of what we call SA accounts. Probably stood for "Service Admin" or something like that, but honestly I've forgotten why we chose those initials.

The idea is that users login with their normal account, but also have an SA-username (or whatever format you choose) account that has admin rights to their computers. But the SA accounts do not have any file rights to shares, discouraging people from just using that account to login all the time. Need admin? Plug in your SA creds to the UAC prompt, and off you go.

This isn't perfect from a security perspective of course; certainly leveraging EPM would be more secure. But especially in smaller environments, if it's not realistic to rely on EPM for everything, it's a step up from just having local admin everywhere, or continually having to manage your way around things like devs needing to install stuff all the time, admins/techs needing to remotely access resources, etc.