locking down users from installing software using group policy

 i want to lock down the users from installing software whats the best way to do that?

whats the best way to do it?

and whats the admin way of installing software for the users on the users account that locked down?

edited:

also how do i ask for more control over group policy?