I do not recommend trying to lock down administrators. It’s much better to manage admin access, but if you insist you want to swim in the opposite direction from Apple locking down the system in DEP and enhancements on MDM with Big Sur, start with a product like DeepFreeze.
Their Mac management solution is the best of you want to sacrifice the more efficient modern ways to control changes. Now, once you price out that software or underwrite a “built it again ourselves solution”, look again for Apple to partner and get acquainted with how well DEP and MDM work to achieve all of your goals and not just the unintentional modification of files issue.
What you are after is MDM supervision and device enrollment. That is the efficient and modern way to secure corporate assets and as a benefit, your IT enrollments will be zero touch and enforced by Apple. Mojave and newer are quite well designed and Big Sur has some massive levers to further secure against file modification out of the box even without DEP+MDM.
Apple offers free advice and consulting to get any business started down this path and offers paid professional services any time you want first part support or enhanced services past the basic free accounts needed to properly secure all devices (Mac / iOS / iPadOS / tvOS / watchOS).
By enforcing code notarization and signing, you lock down all the modifications whether malicious or user generated.