What I would suggest and have proved to be working is creating two separate sites. One is certified site where anything that is published goes through check process thereby ensuring the quality and reporting standards of your organisation. Another site is so called "Uncertified/Ad-hoc". This is the site where you allow your desktop users publishing rights abiding the Tableau norms.
So what I am saying is that you have control on publishing in Certified cite but you allow freedom for desktop users to publish to adhoc site. There are certain things you should make clear to your desktop users/publishers. They should abide by Self service BI requirements and there contents shall be deleted from ad hoc site after some period of time. This is because you want to ensure that you have good Tableau performance and ad hoc site will not use the unnecessary resources.