Setup Local Power Users but Disallow Instalations

Hey there, I am currently in a bind. I have a program that all of my client computers have to run but when printing checks the application needs power user permissions. I would like to make a power users group in AD but disallow installs simply because I don’t want users to find out that their computers are ‘unlocked’ I guess you could say. I have about 25 pc’s and all my users have roaming profiles so I cant go around to each pc and just add them as a local power user.

If anyone knows a fix it would be greatly appreciated.

Thanks!
– Kevin Neberman