Is there a way to restrict admin level users from accessing workbench directly but still letting them push archives or packages using MSM and Package Manager?
If not, would it be a good solution to create a new role (exclusive to access workbench items) and let only that role have write access on all the objects of workbench?
Ravi