Provide the password for elevation and educate to only type that in when they are installing something they know is secure. Likely they will forget the password and have to check with their "IT helper" anyway, and sanity check there actions then.
I have a Windows 7 machine setup like this for my parents and they have never had a problem with malware. The stuff that lives in the user profile gets caught by AV, and I have to install something for them maybe twice a year.
I would rather put in a little extra work setting up a Windows laptop than send metrics for the entire system to Google. Their Android phones take care of that invasion of privacy.
Or I could get them to buy something far cheaper that's already secure, rather than having to learn how to admin an OS that I have had no need to use for nearly 20 years.
> check with their "IT helper"
The whole point is to avoid being an "IT Helper", otherwise I'd just give them an ubuntu laptop.
> The stuff that lives in the user profile gets caught by AV,