I spent a few years consulting on repackaging software into Windows Installer MSI setups to be used in automated deployments. Some of the articles I wrote during this time remain popular to this day.
Disclaimer: This article is now very old (in Internet years), so you are at your own risk in heeding any advice herein. Microsoft has been promising for a while that they would overhaul the LockPermissions method for setting permissions within MSIs, but so far they haven’t.