OK, from reading the referenced documents it looks like I need a combination of Group Policy loopback to effect user GPOs specific to the computer OU and ACLs to restrict the settings to non-admins.

Piece of cake