Hello there. FIrst of all, don't change anything in the roles and leave the default roles. If you have enabled Email-based self-registration to the site and Self enrolment to the course then by default they will have the student role and you don't need to worry about them having any admin rights. So yes, it is " a given". Also - have you looked at our Admin Basics course on the site learn.moodle.org?