Windows system-install: Possible to install extension system-wide and prohibit further extension installation?

[ctr49]

When performing a Windows system-wide installation (using the msi installation method), is it possible to also install extensions system-wide (like the built-in extensions) and prevent (non-admin) users from installing per-user extensions either using vscodium options or implicitly through file system permissions? (Note: just disabling the marketplace would still leave the local vsix installation as an option)