Seeing as you're on workgroups and not a domain, can't you just go to each pc, log in as an admin and alter group policy?
Its gonna be a bit of a job doing it on so many pc's, but then thats your company's fault for not have a DC, tight gits.
That many pc and groups = DC for sure!!

Anyway, as long as your users log in as restricted users i'm sure you can do what i've suggested.