To provide some background, our company has GCC High, and we have it set to where software can only be installed with administrator privileges. However, since some apps can be downloaded to certain locations, such as the local directory, without credentials, I'm thinking this is not an acceptable alternative implementation. From what I've read on past related posts, using something like AppLocker has been mentioned, but from doing my own research that whole process seems extremely tedious and high maintenance.

Is there an obvious solution I'm missing? What are some solutions/tools that you have used to meet this control?