Chris,
Youre understanding of the way DotNetNuke works is spot on, and within your question lies the answer.
The areas of the template you want editable are going to be panes, and within these panes you'll be able to insert modules to handle the type of content e.g. images or text e.t.c. It's these modules, together with the roles and permissions you can assign in DNN that are the key.
Not everyone that accesses a DNN site has the same permissions, so therefore not all your clients will be able to go in and add modules, change images or move things around. At the top of the tree is the host; who can do anything within the DNN environment. Then comes the admin; who can make changes to anything within a specific portal, but only that portal. At the bottom of the pile is the registered user who has access to limited resources, but in the middle are the roles you create, that have access to only the areas and functions you define.
An example of this would be that you create your own "website admin" role, with the intention of letting these users access the site and only change images and text. You register a client, and then assign them the role of "website admin". So now that you have a user you can give them restricted access; while you're setting up the site, adding modules to pages and filling in the default content, set the "Edit Module" permission within the module settings to "website admin". Now when a user with that role accesses the site, they can make changes to only that module.
To control the type of content they can add you'll need to play around with the settings for the individual modules, or pick/develop modules that do exactly what you want.
As an example, we've got a short video that covers this topic: http://www.youtube.com/psdtodnn#p/u/1...
Hope this helps,
Rick.