At this point you can leverage Microsoft In-Tune to manage app installs for mobile devices and to be fucking honest should already be in place with tight restrictions. If they don't, then we as a nation are fucked as government phones are not being restricted from installing/running any app in the playstores and we already know how many unsafe apps are out there that only get removed later.