Apple focused enterprises now have a great solution.
Privileges for macOS it’s designed to allow users to work as a standard user for day-to-day use, by providing fast access to administrator rights when needed. When you do need admin rights, you click on the Privileges icon in your Dock to have it for a preset period of time (default of twenty minutes).
SAP and Apple have been working together in recent years. As of a year ago, they had 17,000 Macs, 83,000 iOS devices, and 170 Apple TVs. At that scale, they certainly know what they are doing when it comes to managing Apple devices at scale.
You can download Privileges for macOS from SAP’s Github page.