You could create an automated action for write on model ir.module... When a user click on install, a write is done with status "to_install" via function state_update... There you can check if it is allowed or not according your own conditions... Or add you custom code in function button_install_immediate... Do it in a module depends 'base' with mode auto install so it will be installed on each database automatically at creation... Just a tips, a better solution probably exists...

Thanks for reply @Jérémy, useful tips. but they require me to be involved in development of this feature for me in some level, if I want to have it... however, I think Odoo should deliver such setting out of the box. It should be possible to setup this somewhere in settings or somehow, is it? that's my question.

one more option by @Jérémy:

I dont know the impact but you can maybe try to do it with access rule removing the read access on some ir module... (Eg: ir module with name like website% is installable (writable) only by new group settings_website) But even if it works... that will be an hard configuration ...
JKE