That's why the documentation prod gatekeeping is critical to long term company health.
You're not going to stop them doing things -- because there's never "enough" IT / they always have Excel.
So what's the next least bad?
IMHO, give them something flexible enough (RPA) that they don't have to go outside of the box + require they leave a documentation trail of what / why they built. (Oh! And teach them about SLAs and SRE best practices!)
Then come down like a ton of bricks if they don't follow the latter. Carrot & stick.
Cheaper pressure release valves (RPA), not expensively overengineered containers (hiring more engineers).
---
Ironically, the hardest conversation at (insert F500 I designed an RPA practice for)?
"Business users shouldn't be able to use IT change control tools!"
Wait... isn't this exactly what we're always griping they don't do?