Best policies for workstations?

Question

Windows

Recommend the best group policies for windows workstations that are suitable for most cases (for example, deny access to the console to the control panel)

Answer 1

There's a default normal user policy is enough...

Answer 2

There is a baseline security analyzer and GPO baselines from MS.
Everything else is built according to customer requirements.