With Android+ agent, you can at least use"disable install from unknown source" feature control to disallow installation of .apk file copied onto the device by any means.

Next, if you block Settings with Feature control or application-run-control, and has no Google account added on the system, installation from Google Play store is not possible.  Otherwise, you can consider blacklisting Google Play Store app to disallow installation of apps.

The most secure method is to add an application whitelist in application-run-control to include all the apps allowed to be run/installed on the device.  Any apps not on the whitelist will not be installable, and any apps freely bundled in the device firmware will be disabled.  This approach should work for many, if not all, Android+ agents.  But care must be taken not to miss out any system apps and services, without which the device may become unstable or unreliable.

If you are bold enough to switch to use Android Enterprise agent in managed-device mode (which requires factory reset of whole device),  then it is possible to include various feature control options to disallow any non-managed apps from being installed by device end-users, and can often save the hassle of building the right application-run-control whitelist.