Need to Remove admin rights on intune windows domain join devices.

Dear,   I ham testing to enroll devices in Intune, but first requirement is to fulfill that normal users should not allowed to install anything only admin users can install it. Please guide here.