Third party apps installation when 'unknown source' option is disabled
Being technical, if the default app store doesn't use an encrypted connection (SSL/TLS), you can perform a MITM attack, and intervene the downloading process, and replace the app with an APK you've prepared.

A computer running Linux is strongly recommended, but a more user-friendly approach could be using zANTI to intervene.