> It's trivial to make it so that a user can only install whitelisted software from private repos.

This is also straightforward on Windows with AD-managed Group Policies.