How do I ensure that users can run only applications that have been installed in /Applications?
You can easily do this by managing apps for that user in Parental Controls.

See this screen shot to limit apps. It is a per-app setting, so you need to maintain the list of allowed apps. The setting you posted in your question is for managing the code signing status of apps and not for restricting certain apps and certain user accounts.