Here is what i did to work around my issues.
I downloaded the portable build of CCleaner on a network share which users only have read access to (cant modify the ini which has updating set as disabled). I have a few other tools which i use to download (httpget) this weekly (windows scheduler) and unzip it (7zip portable) to that folder overwriting files, thus keeping it up to date and free of bundled software.
A link on the IT homepage lets the users run it from their mapped drive without having to hunt it down. Brilliant!