providing user with certain control for computer

Hello,

When creating new users for a computer on a network, I have either assigned them with either standard user or administrator's privileges.

Is there a group where I can assign user with privileges somewhere in between.  For example, preventing user from installing new software, but provide them access to install updates for software that is already installed on their machine (e.g. upgrade flash player, a new version of firefox. etc).

Does this sound like a role of a power user?

If anyone can provide me with pointers and how to go about achieving this, I will be much appreciated.

Cheers