Modern Android devices now have the "Device Protection" option that does a bunch of things, including disabling side loading. And I think you can enforce this via work profiles too.