Why do you want to do that? In my experience users will always try to take advantage of the situation. Yes, you
could create a group policy that allows users to d/l and install certain apps on their own; but that is a lot of work and once you start you will never stop.
If manually installing it (remotely with vnc) is not an option, take the .exe file and create an msi (good explanation here
http://www.mcse.ms/message948078.html), then push it to the users when they log in using a kixscript
www.kixtart.org/. After authenticating to the network, the user logs in, the package will be installed and least privilege is still maintained.
Once you have the initial leg work done, you will have a managable system for deploying anything; without giving up an ounce of control to the users.