Restricting Software Installation by End Users in M365 – Best Practices

We would like to restrict end users from installing software on their devices and only allow installation when explicitly approved by an administrator.

One method we are considering is to create two groups on the admin side: a Normal User group and a Local Admin group. End users would be moved to the Normal User group by default, and only temporarily added to the Local Admin group when they request permission to install software.

However, this would require reassigning all users to the Normal User group initially, which could be complex and time-consuming.

Is there any feature in Microsoft 365 or Intune that can help us manage this more efficiently? We would appreciate any recommendations for a better approach.

Thank you in advance.