If your using active directory you could create a group policy to run login scripts, meaning the users dont have to be local admins.
If the updates are msi's assign them via AD, even if they aren't msi's you maybe able to create a msi using winstall.
Topher