Take away admin rights, but the issue with that is that many programs don't need admin rights to install. Games, etc... install with no issues. You can setup a Group Policy to allow only certain exe files to be run by the users, but I never could find a way to tell Windows to just not to allow programs to be installed by a regular user.
Maybe there is a 3rd party management tool that can do that.