i dont think its necessary to completely lock things down - just do whatever is possible to prevent a clueless user from fucking up during installation
Yeah seriously though just keep all the freedom and accessibility but remove any ability to brick their sudo or other things (or administrative privileges) Disclaimer: Please use those privileges responsibly newbies :)