Great advice provided by everybody previously! We essentially use the custom.cuix for the user and a business unit.cuix for the enterprise. Loaded into the Enterprise is the standard acad.cuix, acetmain.cuix etc which makes the OOTB cuix's read only.
Your clever users will learn quickly that if the load the enterprise as the main they can then edit it, one edit will the effect all referencing.
Just a thought but what about hosting the CUI's on a shared network location in a folder where users only have read options and no write. Then even if the switch the enterprise and main they still won't be able to edit it.
You could then look at DFS as a replication solution for your standard content and share from one master location to all, this will aid the update process.
To load everything, we then use a drag and drop LISP that loads a profile on demand, preconfigured for AutoCAD. This loads the cuix's needed and writes to the custom.cuix a copy of the master workspace to the custom.cuix, essentially it's a copy of the master which is editable. If that were to become corrupt, select the master which is read only and overwrite that for the user workspace.