As far as I know, there is no such function offered by any MDM vendors available on the market.

If your devices are all corporate-owned device of a small number of device model(s) with only managed applications allowed to be installed, one possible workaround is to include the full list of app in a whitelist defined application-run-control profile payload.  Then, even if you allow installation from unknown sources option in feature-control profile payload,  only apps apk with bundle-ID defined in the whitelist can be installed.