Also, be sure to file Feedback with Apple (use your Managed AppleID if you have one) requesting that Safari's extension management be improved to match the Chromium-based browsers. Right now, Safari can be configured to allow extensions or block them, but compared to Chrome or Edge it cannot be set to force or allow some extensions but block everything else.
Further, the GUI is very confusing - even when set to block all extensions, Safari's preferences still show an Extensions button, and an end user may believe they have successfully installed an extension from the App Store even though it won't function. Many Safari extensions also install a 'stub' app into Applications, which can cause incorrect or false positive results in inventory.
This shortcoming of Safari is one reason my org won't be able to support it, compared to Edge - a so-called 'deployment blocker.'
