I was a little hesitant to write this reply because I might not fully understand your comment. In particular, I do not understand why you added the 3 words "for your users" to this next sentence:
>And on OS X at least, it is tricky (or maybe even impossible) to proactively disable unwanted notifications for your users.
It was possible for me to turn off all notifications on OS X. This next command line got rid of most of them, leaving only the occasional notification from Firefox and maybe some other app asking for permission to upgrade the app. Then installing and using Growl from the Mac app store got rid of the rest.
launchctl unload -w /System/Library/LaunchAgents/com.apple.notificationcenterui.plist; killall NotificationCenter
The only disadvantage I am aware of of turning off all notifications in this way is that when there is a new security update for OS X available, it remains uninstalled (because I remain unaware of its existence) until I manually open the app store.
A running app can still get my attention by bouncing its dock tile, but they do not do that often enough to be bothersome, and in the case of my IM client, the bouncing is welcome (because it is how I find out someone sent me an IM and because my IM client can be configured to refrain from bouncing its dock tile for events other than new IMs).