You can handle those issues with power, setting group policies, and inhibiting action when the power button is pressed (that includes keyboard power buttons). Nothing will stop the user from killing power by holding the physical power button down, except for changing that setting (if available) in the BIOS.

Computer config->Preferences->Control panel settings->Power options

Jokes aside, how could I implement such a policy?

The policy you’re looking for is in Computer Configuration->Policies->Windows Settings->Security Settings->Local Policies->User Rights Assignments->Shut down the system

This policy takes account or group names from your local or domain AD as its variable (like Domain Admins). After it’s successfully applied, only those users or groups will be able to shutdown the machine gracefully.

Create a new GPO or edit an existing one and apply it to the ADUC organizational unit containing the computer objects you need to target.

Yippee ki yay

Sirius XM has entered the chat