Are you certain they are using the standard account they were assigned or an admin account they might have gained access to?
A standard account does not have the capability to install software. Not unless some vary serious changes have been made to system security. And such could only be made with an admin account.
its the standard account if face I created a new one just to try and sure as you know what I can install.. I did a google search and found several links whee users were able to install all so..
As I understand it (and the way I have it set up) if the Admin account has a password assigned to it, then in order for a standard user account to install anything they need the admin password. If the Admin account has no password then I think it just has a pop up asking for you to click to allow.
I have an admin account, password protected.. but for everyday use I have a standard account, if I try to install anything it asks for the admin account password.
Though like you say, I have seen it able to install say browser (user specific) add ones without asking.
Seems like your only real option is a registry setting
try looking at the group policy settings
Download Group Policy Settings Reference for Windows and Windows Server from Official Microsoft Download Center
Good luck