Shared Device / Encryption and Admin

I am deploying a few machines as shared devices as described here: https://learn.microsoft.com/en-us/mem/intune/configuration/shared-user-device-settings

Can anyone help me clarify if I can deploy a Bitlocker configuration profile to these devices, as they will only be operated by standard users?

I'm also wondering what the best practice is for local admin rights. For just a couple of machines I have software that won't deploy nicely so was wondering how to do a local install on the machines? I also have something that needs elevated rights when run as a standard user.

This is not my field of expertise and I'm struggling to find answers online, so perhaps I'm asking the wrong questions! Grateful for any guidance!