SMC: Only whitelisted apps allowed in Apple App Store
Currently, although there is a possibility of whitelisting/blacklisting apps in SMC, there is no way of actually allowing App Store on the device and restrict the downloading/installing of apps. To have full control of the device, you have to actually implement a policy of disabling the App Store itself.
Ideally, the App Store should be available and only whitelisted apps are allowed to be installed. This would also allow the users to update the installed apps. The current solution is a drastic push policy to allow App Store, ask users to update apps and ask them to call back when ready to push another policy to restrict the App Store - certainly not the ideal solution.