User OS rights for installing patches on pc

Our policy of desktop-users, is that they are not able to install software themselves. Installing patches of SBO, requires however, "power users' authorizations on the local pc. Does anyone experienced this situation and could you tell us about the best way (most secure) of handling it.

Thanks!