Advanced Mac file restrictions? Is there some sort of software or feature that grants us a more granular ACLs for files?  We are going to start deploying Macbooks to our users for the first time.  Each MacBook will have Parallels Desktop on it with our company image on it.  This creates a .pvm file.  

We want to be able to prevent the .pvm from being copied to an external drive.  Problem is, our user's will be admin users so our options are limited.  Encryption of the file is a no go because we don't want our users to have the ability to move the file somewhere and still be able to open it.  Is there a way to prevent another admin user from being able to copy the file?  I've tried uchg flag but it causes issues with launching the VM where it doesn't even allow you to.  

Is there some software that does this, or can anyone make any recommendations on how we can handle this?

Thanks
No, that's not possible on macOS - and it's not possible on other operating systems either.

Essentially if the user has administrative access, can install their own programs, and they're able to read the file (which is necessary in order to use it with Parallels Desktop) - they'll also be able to copy the file.

However you can do other things to get nearer to the goals that end-users will be able to (a) run your virtual desktop and (b) not copy your image file.

A common way of doing this is to run the virtual machine image on a server, and only allow access over a remote desktop protocol to use the programs on the image. This is often accomplished using Citrix or various solutions from other vendors such as VMware or Microsoft.

Another option you have is to limit the computers physically. For example some companies "glue" USB ports and similar to ensure that users cannot easily plugin external drives. You can do that with USB-C and Thunderbolt ports as well, but you'll also have to think in copying over the network. If you have to disable WiFi and other networking options as well, you'll probably end up with unusable computers.