That policy may source from the CIS Benchmarks, but is intended for servers, not for user workstations. To quote §184.108.40.206 (and note the Profile Applicability and Impact sections):
220.127.116.11 (L1) Ensure 'Shutdown: Allow system to be shut down without having to log on' is set to 'Disabled' (Scored)
- Level 1 - Domain Controller
- Level 1 - Member Server
This policy setting determines whether a computer can be shut down
when a user is not logged on. If this policy setting is enabled, the
shutdown command is available on the Windows logon screen. It is
recommended to disable this policy setting to restrict the ability to
shut down the computer to users with credentials on the system. The
recommended state for this setting is: Disabled.
Users who can access the console locally could shut down the computer.
Attackers could also walk to the local console and restart the server,
which would cause a temporary DoS condition. Attackers could also shut
down the server and leave all of its applications and services
Operators will have to log on to servers to shut them down or restart them.
The idea being that a user might not have privileges to log into a server, but with physical access, they would be able to shut it down. Consider the HVAC guy working in your server room, etc. etc.
It is reasonable for you to allow your users to shut down workstations.