You are so brainwashed by app stores' talking points that you don't realize you are describing computers.

Just let users install whatever they want. Maybe add a verification process (a-la app verification for Mac) if users want to be restricted to verified apps. Show a "this is from an unverified developer" messages if the app comes from an unverified developer (is not signed).

There's no need to draw lines. Leave that to painters and architects.