Acme Corp needs to implement Private Marketplace within their AWS Organization to allow developers to purchase approved third-party software, while restricting administrative access to the procurement team. The procurement team at Acme Corp, using an AWS Organizations structure with shared services accounts in each OU, requires a design that allows developers to purchase third-party software only from an approved list via Private Marketplace, with administrative control limited to procurement managers assuming the procurement-manager-role, and all other IAM entities denied administrative access. What is the MOST efficient way to design an architecture to meet these requirements?