It would be helpful if users could completely disable certain features on devices, a setting that could only be reversed by administrators.
These would include, for example,
Updates via RMM for clusters
Restarts via RMM for clusters
File Explorer on the system provider’s internal devices