At least I would need exacly one locked entry in GP for Firefox:
lockPref("autoadmin.global_config_url","an url...");
Everything else would be read from that URL and nobody have to care about further settings in GP.
This would allow admin to set really every Firefox parameter.