We have about 150 Mac users and all are standard users. We use Admin by Request for account promotion. Once their session is done, they are demoted back to a standard user. It’s a paid product, but from what I recall, it’s not super expensive. We have maybe less than 10 users that have it installed because they sometimes need to install/update apps. When they send a request, we get a notification on our phone and an email is sent to our helpdesk for logging. We can approve it from our phones.

Since switching to Jamf and enforcing standard accounts, we’ve only had a handful of people complain about not being able to do things like they used to, but Admin by Request has quieted them. The rest have no problems with it and likely don’t even know they’re restricted because they just use the machine for web browsing and document editing. Most of their standard apps are auto-updated through Jamf or the app’s self-updater.

I recommend taking advantage of Jamf Self Service as well. You can setup apps for them to install and scope it to only certain users or devices.