Push the DisableOSUpgrade and that other registry key, I do this as well as the GPO (in the new admx) option because I really do not trust Microsoft.
If you're really paranoid look at aegis script or something to pull that.
Users with local admin rights are the spawn of Satan.
However, over the years I've seen way too many business applications that want local admin rights. No, no and no again. I'm sure Sage (spit) used to demand this.
Actually you don't need to give that software/user admin rights to the whole PC.
What you do is find the folders/registry keys it needs access to and give A GROUP access to that folder. You can push this via GPO easily so won't need to do it per machine either. I include mine inside the same policy that deploys the software, though sometimes I push these permissions even if the software has no deployment package. You then add users to this group, even if its the "everyone" group to this group, still better than
Even if you don't push these changes with GPO you need to DOCUMENT the changes, even if its just a notepad file stored wherever the installer is located.
Then look at SRS or the new AppLocker (if you have Enterprise) to restrict the rest.
If you are unsure which folders to allow access to, you can run up Process Monitor (SysInternals) and look at denied folder entries for the process of the application you're running. An audit like this should only take 10-20 minutes.
If the user isn't a local admin yes. If they are then they can perform the upgrade.
As I said, as we have a fairly small and trustworthy staff, many people are in fact local admins as it makes installs/maintenance much easier.
Trustworthy doesn't help with accidental changes/installs and/or the spread of said malware etc.
