How can I prevent installation of NEW applications on an Android 5.1 device, but keep auto-updates of existing applications?
There are multiple approaches you could take:


a kiosk-mode solution. That would pin the user to a certain app or group of apps defined as "kiosk"
parental-control apps, which are often a specific variant of kiosk
use an App-Locker


The latter most likely is the approach best fitting your current case: You can define which apps should be "locked down" and which not. Locking e.g. settings and the Playstore app, while unknown-sources are disabled, would prevent any new installations. With auto-updates enabled in the Playstore app, these would still be applied automatically.

For additional details, be welcome to click the tags (for questions using them), or take a look into the corresponding tag-wikis: kiosk-mode, parental-control, unknown-sources.

Note that, to prevent installations via the Google Play web interface, the user must not have the credentials of any Google account linked to the device (no chance otherwise).1 These do not necessarily correspond with the lockscreen PIN/password/pattern, so this is no contradiction to your requirements.



1: credits to Firelord for pointing this out