The part in the configuration file where it often says "ALL=" can be replace by the host name, or an alias for several host names, if the host has the ability to look up its own name in DNS. But that is not needed unless /etc/sudoers is hosted remotely and shared by multiple machines.
As far as the applications go,
sudo can be configured to allow use of specific applications, such as
apt or
apt-get. With care, you can even decide on which parameters are allowed.
Code:
%localadmins hosta=(root:root) /usr/bin/apt-get update, \
/usr/bin/apt-get upgrade, /usr/bin/apt-get dist-upgrade
Or, wildly,
Code:
%localadmins hosta=(root:root) /usr/bin/apt-get
See Michael W Lucas' talk "sudo: You're Doing It Wrong" in either slide form or video. He'll have a new edition of
sudo Mastery out sometime maybe this year, but that won't help at the momement.