what kind of user rights yo give to domain users?

Hi all. I would like to check with the domain administrators out there, what
kind of user rights are given to user accounts on their local pc. I know it
is best to give only normal user rights instead of admin rights so that users
are unable to install programs downloaded from the internet that may infect
the pc. However by doing so my users face alot of problems accessing customer
websites that require installation of activeX as they are unable to do so.
Hence i would like to normal what other administrators are doing to solve
this issue. Thks in advance.