Make groups and assign users the rights they need.
You can't prevent users from installing software without severly
limiting their ability to use the computer. Some programs will both install and run
as an unpriviledged user.
You can only stop this by making a policy explicitly saying what IS allowed to run, for example, excel.exe, publisher.exe, etc.
By locking the system with gpedit.msc you can prevent alot of software from being installed though. Only grant read access on the registry, and write access only when a program seems to need it. Only provide read and execute permissions to c:\windows and c:\program files.
If you are hard core, do this.
Install 2 harddrives.
On the second partition make a data partition (10 gigs or so) Leave the rest as a backup space.
Get Ghost 2003.
Put a defualt image on the 2nd drive in the backupspace.
Tell your users to store their documents on the data partition.
Run a scheduling program to restore the default image nightly/weekly/whatever to the c drive. If I remember right you can set ghost to do this, but it has been a while. I'm sure there is a way to do it automatically though.