Or just let WordPress users just be users. Abstract the management of WordPress away from the CMS.

Have their access be just the content and limited/filtered by role. The built-in roles need virtually no tweaking.

We have our WordPress sites as git repositories and build via CircleCI, Ansible and Composer. For Multisite instances we use Composer and Satis and keep the themes in their own repositories and use tagged releases to manage our multisite build using CircleCI and Ansible again.

We use two-factor auth for Wordpress login (currently Duo on non-multisite installs). Nobody gets to install plugins. Nobody writes files into folders manually.

Minimal plugin usage is a solid recommendation.