How do apps installed via Mobile Device Management behave?
Having an MDM doesn't change the permissions and app deletion behavior on iOS so it only facilitates getting a redemption code onto the device.

What really matters is who signed the app. If the app is signed from Apple - then it doesn't matter if it came from iTunes, iCloud restore, MDM or Apple's app store. A user can either delete all apps or no apps based on the iOS profile in force.

Now, for enterprise signed apps (or developer signed apps), you can tie a signing certificate or trust chain to a configuration profile and ensure that apps signed by that cert get deleted when the profile is deleted.

So a user can decide to remove one app or remove all apps or remove the profile. But the user can't remove the profile and have the apps remain.

This is a nice general overview. If you select a particular MDM solution (Casper, AirWatch, Mobile Iron, etc..) or just use iPhone Configuration utility or Apple Configurator - you can re-ask this to nail down your particular deployment scenario and we can dive deeper into what you seek to accomplish.