Block all the automatic update of plugins, theme and core of wp.
Create 2 kind of user roles “EditorTLC” and “Cliente”.
EditorTLC has the same capabilities of the Administrator but he doesn’t have access to the plugins page.
Cliente has the capabilities of an Editor and in addition has the capabilieties ‘edit_theme_options’ whithout theme, customize,
editor-theme and tools.
MORE INFO
https://www.tlcws.com