Do you use a local admin account on your endpoint computers or do you disable the admin account?

My organization does not have the budget to integrate EPM into intune. A lot of people say that the admin account needs to be disabled!

I want to use local admin account on the endpoint computer where LAPS is configured, ( no one from my employees will not have password to local admin account except me!).

​

and give all employees local user only access so they can do their work. All required applications are installed through intune

​

If I need to install some application which is not available in microsoft store only in this case I will connect remotely and install the application with admin rights.
Unfortunately we can't use EPM because of the price