Does "Standard User" account allow for software updates?

Hello. I am buying laptops for 10 remote users. The laptops will be used
only in a stand-alone environment, so no domain logins or group policies
would be coming from a central server. I'd like to install all of our
business related software as administrator and then prohibit the standard
user account from being able to install any other software. I believe I can
do this...but was wondering what happens when software updates / patches for
various products become available - vista, office, acrobat, etc.??? Will the
"standard user" be able to install these updates / patches without needing
the Administrator password? Any other suggestions for locking down these
laptops given our environment? Thanks.