Restricting users ability to install.

Long time reader...first time poster. This may be a noob question. I want to restrict the ability for an OD Group to install software (or anything) onto any machine to which they login. If I set the group preference to look like this: WGM > Preferences >> Applications >>> Manage Always >>>> Users can open all applications except these >>>>>Installer.app (among other apps: Terminal, NetInfo Manager, iChat, yadayadayada) ...would that work? Are there any other apps that I should also restrict? Maybe DiskImageMounter? Thanks in advance. This place is so helpful!