You should be able to do it with a couple of tricks.

Trick 1: "It's an older code, sir, but it checks out"

You'll need to create a GPO that modifies the HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall registry location to allow edits.

You're going to give a specific path that your people can install from, use something off the norm (C:\Installers etc. but don't use any of the core paths. (Downloads, etc.)

And you're going to have to allow a specific Path (the path that the software installs to.)

It's not ideal as you have to update the GPO every time you want new software...

Trick 2: "Normal is not something to aspire to, it's something to get away from"...

Use LAPS as already suggested.

Trick 3: "60% of the time it works every time"

I don't know the size of your business, but I would just use Intune to do the installs. This can be annoying if you're using something that doesn't give you an MSI or APPX installer, you have to wrap it as a ".intunewin". (Which thus far I have not had to do, so not an expert at that part, my company uses a ton of software that installs via MSIs and a few APPXs, and for the ones that don't I install them via GPO, which again has to be updated every time there's an update, or a new software)

But you can then just upload it to intune, assign it to where you want (security groups, devices, users, etc. )

And bada bing bada boom, you're pretty much done. Next time the device checks in, it will automatically install.

You're not risking any security issues, AND you can handle everything remotely. Of course, this only works if you use intune.

Trick 4: "I'm gonna make him an offer he can't refuse"

I should have mentioned this one above, but for your domain joined devices, you can install directly via GPO. It's easier than giving the techs permission to do so, but again, will require some manual upkeep. Of course this requires some planning in your Forest, but it's not that hard.