windows active directory group policy consulting up to 1hr via zoom

I have a question on how to lock down a windows 10 desktop in group policy where normal user has internet access but local administrator does not. How do you install updates? I need a well versed windows NT system admin.

Consulting would commence right now in a zoom session. Please be qualified.