look at https://apps.microsoft.com/detail/xp89bsk82w9j28?hl=en-us&gl=US we use it but be cautious an use a whitelist to add apps you have tested rather than a blanket. you don't want to use apps that have user interaction without changing some commands to make it silent. same with Elevated access read the readme

If I understand your question correctly, I'd say: Strategically default to sourcing apps from the Microsoft App Store (new) first. Next, if you have the budget then you'd get something like Intune Enterprise App Catalog to look after other apps not in the store. Other app packaging/catalog services exist. Where there is a budget constraint, you could consider using winget but it can be a steep learning curve and you'd have to automate it yourself, perhaps with Task Scheduler.