On the Restrictions tab, you can currently enter a list of Apps that are allowed to run. It would be awesome to have a checkbox saying Only Run Managed apps.
You could also remove access to the app store as a restriction, and then only applications approved and pushed out via VPP and device assignment will be allowed to run.
