Registry key to block users from adding to trusted certificates?

I'm trying to figure out how to block my users from having the option to add a certificate to the trusted ones. Basically I'm using the customization wizard to pre-build a Reader DC build with all needed settings, that trusts the Windows certificate store certificates and the Adobe EUTL lists. For that purpose, I don't want them to be able to add unknown certificates to the Adobe store.

The Adobe Windows Registry Reference at https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/index.html is more than detailed, but there's a zillion of info in there and don't know where to start looking...