So what you want to do is lock out the App store, and use Self Service
to setup a whitelist of approved apps which the students can install. I
suggest you stop calling them in-house apps, because thats not what they
are. This currently cannot be done...