Aside from what the sibling comment said about the "local" install, if you don't want them to run sudo for you, I'd bet $5 that so long as the directories end up with the permissions necessary, you could (effectively) `alias sudo='env'; brew install` and it'd be fine. I do not have `NOPASSWD` on sudo and I can attest that with all my years of Homebrew and Linuxbrew, it has never once tried to run sudo "under the covers"
It's not supported officially (ie. if you have issues with a package you're on your own), but it works great. I've used Homebrew like this for a few years.
As do apt, pacman, a multi-user nix install... isn't that pretty standard for a system-wide package manager?