For your question about writing Launch:// Command directly inside the Lockdown-template, I can share with you some past experience.  This was confirmed to be possible in the last few years on various Samsung devices running Android+ device agent.  However, I recently did a brief test on some devices running Android+ or Android-Enterprise device agents, and there seemed t e some problem.  I haven't spent much time to further investigate the cause of the problem - whether it is the newer device agent or the advanced options chosen in the kiosk mode profile, or the way how newer MobiControl server extract profile configurations to update the appropriate application-run-control whitelist.

 

In fact, what you did using hidden visibility style is reasonablly simple and easy to handle a few more entries.   I would stick to this approach if I were you.