Block All Software Installs

Hi All   Is there a way to block all software installs on Windows devices except for those we push out via Intune?   I have have a look in the Device Config settings but there seems to be some co...