iPhone app install- automation
What you want to do sounds possible with the steps you describe, except for 3). You haven't said which MDM server you plan on using but I'll assume it's one that implements the concept of Managed Apps.

Once your device(s) are enrolled with the MDM server, it can automatically push down whatever apps you wish to the device (either in-house/corporate or App Store). Those apps are considered Managed and you will have some control over them, including the ability to remove them remotely.

In specific answer to your questions:


Yes, once you have set up an MDM server and configured the APNS certificate (from https://identity.apple.com/pushcert/) you can enrol and manage devices through it.
Yes, once the device is enrolled you can push apps to it. The mechanism for this differs a little depending on which MDM server you use. Most will allow for auto-push during enrolment or a push notification prompt asking the user to install from the MDM server's App Store.
In order to use AppLock, the device must be Supervised. To enable Supervised mode on an iOS device, it must either be configured physically via a Mac + Apple Configurator or be a device purchased through DEP (Device Enrolment Program). Devices can be Supervised through an MDM server (so over-the-air) but they must be purchased as a DEP device through an authorised reseller in a supported country. Devices that are purchased outside the DEP program cannot currently be converted to DEP / Supervised at a later date.