A Managed Preference/Profile that allows applications to run from the Applications directory only and disallow admin rights.
You could have a LaunchDaemon that has a WatchPath for the Applications path and runs an appropriate script. Then you could write a result to a plist file that an EA reads, but this is, of course, relying on the fact that the App is indeed installed into the Applications directory, since Apps could be installed anywhere. You could run a find over the entire disc(s) space, but the overhead of this would be high. However, with users as local admins they can of course undo any of this, depending on the ability of your user base.
