Can personal profiles be removed on work devices?
You could use apps like AppLock and lock the Play store: this way, without a password set by you the user shouldn't be able to install anything. I don't know if there are better solutions, maybe already implemented in android for work; and I don't know, more important, if this has any drawback on app updates. But worth a try, if you have no other ideas.