If you want to integrate GTM with your internal source control system, they have a programmatic API that you can tie into your build process:
https://developers.google.com/tag-manager/api/v1/
And if you want to lock down what kinds tags can run on your site, they have a nice whitelisting/blacklisting system that lets you block capabilities (e.g. customScripts to block arbitrary JS):
https://developers.google.com/tag-manager/devguide?hl=en#res...