Installing software is not mundane. Do you really want user upgrading the system. Possibly breaking the system because it may require kernel packages not available in fedora, or because the repo is currently broken ( don't say it doesn't happen, because it does ).
Your assertion about local access is totally wrong. You obviously need to secure your computer better.
If users need to install software. They can do it in there own home directory. That's more secure than 1, 2, 3 or 4.