Is their a way to create a command authorization set that would allow all commands in the enable mode, but deny a user from entering into the global configuration mode.

I see read-only examples of just allowing a few commands, such as show, exit, & debug. However, I don't want to restrict them from any commands while in the enable mode.