Device Groups

I am looking for info on how we can use this at my small business where I want the general workstations to be on a full lockdown with access to minimal things, but allow the leadership team to have more availability for things like news, spors, etc. What is the best way to go about this? I was assuming profiles would be the best way to do this, but I was not sure if we can move a device to different profiles after we set them up, and if this is the best way to manage it? I am not sure if the installer will be specific to profile or not hence the questions being asked.

For more background on the ask..

This would be exclusively for our Windows devices in the company.

We would have about 4 different groups total that we currently use policy for in AD, but could make sure they are grouped accordingly in the platform.