Do you currently run AD in your environment? If so I would suggest Centrify DirectControl and its price point isn't too bad. It will plug into your current AD and give you a full Group Policy offering for the Macs. I administer about 75 Macs with the Centrify solution and when the students login they all have the exact same dock no matter which lab or campus they are at. I also created a new AD group for who I wanted to have Admin rights on the Macs because I didn't want all my PC techs to have admin rights on the Macs also.
ARD is the way to go for remotely administering all your Macs. Via Centrify, you can manage who has remote access to the Macs via ARD also. I setup a Mac Mini server as a task server to deploy all my 3rd party software and 3rd party updates. You can also setup your Mac Mini server as an update server and point the Macs to it to control updates and also cut down on bandwidth usage. Using OS X Server's Software Update service with multiple Mac OS X client versions You can also manage printer setup and removal via the ARD UNIX commands. I use ARD for just about everything and I cant remember the last time I physically went to one of the Mac expect on a hardware failure.
Hope this answers some questions for you.
