You can just configure the device to not give the child the ability to download apps without approval.