To disallow animal admins to install plugins, in the German thread it has also been suggested to remove write permissions for the webserver user on
lib/plugins. This doesn't work for me for the reasons I've written above.
Regarding the requirement of having the plugins
deactivated by default in the animals, I've been pointed to
https://www.dokuwiki.org/config#enabling_disabling_plugins. Unfortunately this method would require, that after each plugin installation I'd change
conf/plugins.local.php of each single animal manually. That's just not feasible for more than a handful of Wikis and would also thwart my motivation of choosing DokuWiki.
To disallow the change of specific settings in the animals, it has been suggested to use
local.protected.conf[/m] in the animals. This seems to work and I could prepare a default [m]local.protected.conf for the animals which I'd copy in the animal template.
So the least of my requirements can be fulfilled, but still not the main one, which is to disallow plugin installations by the animal admins and that plugins are disabled by default. Others must have had the same requirements and have found a solution to it. Maybe it's even present hidden in some DW feature?