I agree with Doug I always install using the sa account not a Windows account.
However I had your high security situation a couple of times and this worked (and yes sysadmin is required for INSTALLATION not for regular operation of MAS)
I actually tell them sa login is required for installation those are Sage's rules BUT I don't need the password for it and feel free to change sa password after installation is complete. I ask them to shadow my session and type in the sa password for me so it can create the MAS_User, MAS_Reports accounts, set all the role and db permissions, and create the MAS_SYSTEM db and its tables.
Later when I get to the point where I use the MAS SQL Settings utility to change the password for Mas_User and MAS_Reports (standard procedure for me), the SQL login pop-up will appear again. Now I tell IT guy dude type in sa pswd for me again. Now he can do what he wants with sa since I have everything I need.