Hi Chris,
Microsoft has a product called InTune that will monitor your PC's and allow you to check software updates do install and all that via a simple interface over the web, you may want to give it a peak. The other you can do, is create locked down users accounts on each machine that are set as standard users, and keep the admin user for yourself, look at the parental controls, they can be used to do some of what you want.