Deployment updates for “any” legal software over my Network PCs

Hello I?m Carlos Fuentes from Mexico.
I?m working at mexican company for IT Depth.

We are interested about some software like WSUS from Microsoft to compare how is possible to get a better performance when apply new updates for any software.
We desire block any possibilitie of our “users” can “install and/or update” all software contained or used on PCs.

I found three options like Prism, VMWare and WSUS at this moment. But I prefer compare with somebody that had some similar experience and can share with us, his experience, recommendations or advertisment about issues or relative information.

I?m thankful for any comment around this case