Workgroup prevent user access to Software Updates

Hi all, I'm having issues preventing user access to "Software Updates" application on 10.5 with a 10.5 wgm server. Also have noticed issue with Installer.app which has moved from utilities (10.4) to core services (10.5). Is there away to prevent user access to apps in this location? I have tried adding it to the legacy application items in wgm but no luck. I prefer not to add all the allow apps for obvious reasons. thanks