Preventing unmanaged Lion upgrades

While it seems like a Good Thing for consumer availability, the installation of the Lion upgrade via the App Store has me somewhat concerned. We make use of a Power User group to allow installation of additional software, while still maintaining management of the workstation via MCX, login scripts, etc (not my choice, don't get me started). We also do not prevent users from installing applications via the App Store, since frankly, I don't care, and it's not IT's problem to fix/restore them when the computer needs to be re-imaged (the App Store has its own features to re-install). However, I now have this panic that the douchebag element in our user base - the ones who I know daily install untested updates and basically seem think their job is spend their days installing the latest-and-greatest instead of doing what they're paid to do and actually [i]teaching[/i] - will go out and install the Lion upgrade as easily as they install McSolitaire or Twitter from the Store. And all hell will break loose when unexpected crap happens. Historically there's been the inconvenience of having to get a DVD to upgrade from 10.5 to 10.6 (for example). However the Lion upgrade via the App Store seems to take this away and now makes it far too easy - and at $30, far too tempting - for someone to root up their machine, or at least put it into an unexpected state (eg: printers won't deploy, drivers won't work). I've logged a bug with Apple about this, asking for an MCX key which will allow apps to continue to be installed, but allowing IT to retain control of OS upgrades. Anyone else's thoughts?