Policy to stop s/w installs except one

Need policy to restrict software installs but users run a custom app that they need to be able to modify the reg keys to support changes.

They only need to double click the new .reg file to merge with current registry.

Any ideas? We allow them access to regedit.exe and regedit32 but they still can update with the new keys.

Are there specific restrictions to allow them to modify only a certain key?