We'd like to lock down what the 'admins' can do from the admin interface and control it from configs so we can mode closely maintain things in source control and manage changes to production through out change request process.
Is this currently possible?
@smi-jonathan global moderators exist as a group to essentially be admins but without access to the ACP. If you want a restricted group of admins, that's what you're looking for. If you'd like them to be able to do more, then I'd suggest opening as issue on Github. As for your particular request, no, this isn't possible without a plugin.