Hi @AHauerwas,
As a Canvas admin, external tools designed for integration like this drive me nuts too! My institution is very much like yours in that we do not let teachers or even most admins install LTI tools, as we have an approval process they must go through before being used.
I do have a couple questions... I'm assuming this must still be a LTI 1.1 integration? If so, are they using a unique key/secret for every course, or just a unique URL? I ran into one tool which used a unique URL per course in a module setup, but the same key/secret. In that case I was actually able to install it as an account LTI and just populate the domain field, then the faculty member could select the tool from the module -> add external tool option and paste in the exact URL for the course. As long as the domain matched, it all worked seamlessly and avoided a bunch of course-level installs. Maybe this would work for you as well!
-Chris