Group Policy is low key the most powerful thing in tech. Secure all the clients? Yes. Personalize all the clients? Yes. Install software? Sure. Disable unsafe browser features in third party browsers? Also yes!

Group policy is such an insanely convenient configure-once-apply-everywhere system, I'm still not sure why anyone would run a corporate network without it. Modern MDM solutions don't even come close to the extensive level of customization you can do with a GPO.