LaunchDaemon assistance
not really an answer, but maybe a hint as to where to go next...

To catch it earlier, you'd have to intercept it at the download folder. I'd guess the folder name will be different for everybody - mine is at
/private/var/folders/nc/c83zpk8x7kd9qrxrd3nnbfym0000gn/C/com.apple.appstore 

You can find it from the App Store app > Debug > Show Download Folder... if you enable the debug menu with
defaults write com.apple.appstore ShowDebugMenu -bool true