I use a Microsoft Policy CSP within a profile for this. I followed Grischa's blog post when I preformed this setup. See the link below.
https://modernmanagement.works/windows/manage-local-administrators-groups-with-csp/
