Is there a way to do this in 6.5?

We tried making users "User" local account, but it still lets them
install some apps, plus still messes up the system on the ones it can
prevent. We're currently using Zen 3.2.

thanks