They do not do installs.

Not sure what DAC enablement is for? If the server is down, we bring it back up for them.

We just feel the DBAs need to stay off the server to prevent any possible damage to the server itself.

If SSMS gives them what they need, why risk giving them RDP access?