Jokes aside, how could I implement such a policy?

The policy you’re looking for is in Computer Configuration->Policies->Windows Settings->Security Settings->Local Policies->User Rights Assignments->Shut down the system

This policy takes account or group names from your local or domain AD as its variable (like Domain Admins). After it’s successfully applied, only those users or groups will be able to shutdown the machine gracefully.

Create a new GPO or edit an existing one and apply it to the ADUC organizational unit containing the computer objects you need to target.