Best use of rights in Win2k

What is the best way to implement rights in win2k pro. We want them to be able to access application related to work. i.e. cd burning applications desktop publishing, office apps. What we don’t want is to let them load unrelated 3rd party software, games, any downloads that would affect the performance of the workstation. It seems in some cases our only resolution is to give them admin rights to the machine but if that’s the case they might as well be on 98….Please any advice would be helpful!!!!