The LEM Agent runs as a service, so you should be able to remove the user's access to Administrative Tools > Services using Group Policy, and that would make it so they couldn't stop it. It doesn't show up in the system tray, so that's not a concern. Otherwise, that leaves Add/Remove Programs and Task Manager. I'm not sure whether you can block those in Group Policy, but you could probably find some workarounds online if you can't.
Regarding the installer, check out the following article about how to put the installer in "silent" mode. That way you can push the Agent out using Group Policy or similar without the user knowing it's happening.
Hope that helps.