Restrict 2nd Local Admin Account From Changing Network Settings - Non-Domain Joined Device

I keep hitting a dead end on this one. When initially presented with this issue it seemed like an easy fix but every thing that's come to mind and everything I've checked so far have been a dead end.

To save time and get the follow up suggestions and questions out of the way... New environment for me (almost 2 months). Yes I know this should be done differently. Yes I know they don't actually need full local admin access. Yes I agree this should be done differently. Yes I know that's how you would've done it. Yes I know this should be done differently.

Manufacturing environment. Industrial machines with built in controllers and stations running W10. These machines connect to specific services for their job functionality. Pull files from a vendor database or something. They aren't domain joined and the machine operators use local admin accounts to be able to do what they need. I implemented some network policies restricting them much further than they were before finding out about the local admin access and before finding out the the machine ops can just change the local network settings if needed. No I don't know the entire architecture yet within 2 months. Yes I know you would have done it differently. Yes I know I can lock it down further.

The actual question I need help with is if it's possible to implement a local policy or security setting that would prevent a specific local admin account from being able to change network settings either through GUI or command prompt. I'm sure there are dozens of 3rd party options and bells and whistles I could throw at this situation but lets pretend there arent and this needs to be done natively and locally. My brain is already a bit mush from trying to comprehend several things around here without asking questions that wont be answered. (or cant be)