Managing Mac users

Solution 1:

Let them control everything, give them login access to network services etc and their own responsibility for backups.

Then if there is an issue you just install the latest "standard" image and they sort the rest.

Solution 2:

I mean, it’s the obvious answer, so why not take a look at Jamf Pro? It’s not free, but it does everything you want and more. You can set policies for individual machines or groups, run scripts, create users, add printers, push preferences, and much more. There is even a Self Service app that allows you to provide apps, settings, printers, etc. that the user can install themselves at the press of a button. And you can determine which users or machines have access to which apps in there.

It’s a very powerful system, and can be run on-premises on your own server, or in the cloud and thus be available to machines even when they are not on your company network.

(I’m only suggesting this as a happy customer. I have no affiliation with Jamf.)