I want to check my entire October project into Git, and use Composer to manage the October core, as well as all plugins and themes. So, I need to prevent admin users from installing/updating plugins and themes (or doing anything else that would take the project out of sync with the git repo).

I know that I can prevent admin users from updating the core by setting disableCoreUpdates to true in /config/cms.php. However, I couldn't find a way to disable the Settings > Updates & Plugins > Install Plugins and Settings > Front-end theme > Find more themes pages in the backend.

Is this possible? I'm sure I could hack this one way or another, but surely there's a "right" way?

Thanks!

Why not create the role / group? I would personally create a "super-user", disable them from certain things from the core and leave the admin role vanilla.