When my kid got her Mac I set up her user account as non-Admistrator. Then I set up a second account as her Administrator account.
The new version to which Herman linked does not require a password, but it does require the account to be an Admin account.
So in my kid's case, it cannot install, unless she Authenticates.
Similarly, if my kid is in her standard user account, she does not have to go into the Admin account to install software etc. When she tries to install it, it will say she does not have sufficient privileges, and ask her to Authenticate, which simply means entering the user name and password of the Admin account.
This is pretty standard in corporate setups: the user retains full Admin capacity, but their daily working account is not an Admin account. This does not negatively impact their work in any way.
My wife's MacBook was set up the usual way - with her account as an Admin account. last night I simply added a new Admin account, then changed her everyday account to Standard.