Enabling users to install updates

OS: SBS 2011
Client OS: Win 7 Pro

End users are calling up requesting the administrator password, to install updates for things like flash player, etc. for Radio's etc.

All users are standard users with administrator links, my only ideas are;

1)create an admin account locally and give them login (Which I don't not want to do)

2)Give the user complete admin wrights

3) Use GP to install, applications using .msi

Is there anyway I can give them restricted administrator access, to only install updates rather then new software.?

Thanks